Secure Android intent entry points by limiting which components are exported, treating intent filters as routing rules rather than authorization, validating every incoming field in code, and preventing untrusted intents from redirecting your app. Apply those checks whether an activity is created for a new intent or receives one later through onNewIntent().
Why an intent filter is not an access-control boundary
An <intent-filter> advertises which implicit intents a component can handle. It does not make the component private, authenticate the sender, or guarantee that every received field matches what your code expects. An explicit intent can name an exported component directly, and an external caller can supply unexpected data. Android’s intent security guidance and intent redirection guidance both emphasize that app code must not treat routing as trust.
Use several complementary controls: minimize component exposure, constrain filter declarations, validate input after delivery, and limit any capability you pass onward. None of these substitutes for the others.
Decide which components other apps may reach
Review the merged manifest—not only your app’s source manifest—because libraries can contribute activities, services, receivers, or providers. Set android:exported explicitly. Components that do not need cross-app calls should generally be private:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches#1 Best Overall
- YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
- LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
- MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
- NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
- BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.
<activity
android:name=".InternalActivity"
android:exported="false" />For a genuine integration surface, such as a deep-link entry point, export the component deliberately and treat it like an externally callable API. Android’s advice is direct: “Don’t export your app’s components unnecessarily.” See the Android exported-components guidance. If a cross-app interface is sensitive, protect it with an appropriate permission; a signature-level permission can suit integration between apps signed by the same developer.
Make filters narrow, then validate received input
Declare only the routes you intend to support
Include only required actions, categories, URI schemes, hosts, ports, paths, and MIME types in each filter. Data matching depends on which elements are declared: a scheme-only filter can match URIs with that scheme across hosts and paths, while authority and path constraints narrow the routes. Consult the intent filters documentation for matching behavior.
Rank #2
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Tracfone plan required, activating is easy, just 3 steps.
- DISPLAY: Immersive viewing on a 6.7-inch super-bright 120Hz display with powerful stereo speakers and Bass Boost for cinematic entertainment.
- CAMERA SYSTEM: Advanced 50MP Quad Pixel camera captures sharp, detailed photos and videos in any lighting condition
- PERFORMANCE: Lightning-fast 5G connectivity paired with a powerful processor and RAM Boost for smooth multitasking.
- BATTERY LIFE: Long-lasting 5000mAh battery with TurboPower charging technology delivers hours of power in minutes.
Check the actual intent in application code
Before taking sensitive action, verify the action, parsed URI, MIME type where relevant, and each required extra. Use allowlists for expected schemes, hosts, paths, and values; validate extra types and ranges; handle absent or malformed fields without crashing; and avoid trusting serialized Parcelable or Serializable objects supplied by another app. Reject invalid input or handle it in a way that cannot leave sensitive state partially changed.
Do this even if the normal route is an implicit deep link or share action. The manifest filter does not prevent an explicit launch of an exported component, and matching does not certify the payload as safe.
Rank #3
- YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
- LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
- MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
- NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
- BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.
Validate every activity delivery path
An activity can receive its initial intent in onCreate() and later receive another through onNewIntent(), depending on its launch mode and how it is started. Put checks in shared handling logic so both paths enforce the same policy. When processing a replacement intent, call setIntent(newIntent) if later code uses getIntent(); otherwise that accessor can continue to expose the earlier intent.
private void handleIncomingIntent(Intent intent) {
if (intent == null || !EXPECTED_ACTION.equals(intent.getAction())) {
return;
}
Uri data = intent.getData();
if (!isAllowedUri(data)) {
return;
}
// Validate required extras before performing sensitive work.
}
@Override
protected void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
handleIncomingIntent(getIntent());
}
@Override
protected void onNewIntent(Intent newIntent) {
super.onNewIntent(newIntent);
setIntent(newIntent);
handleIncomingIntent(newIntent);
}The sample is a pattern, not a complete validator: implement isAllowedUri() against the exact routes your app supports, and validate required extras before using them.
Rank #4
- PRIVACY DISPLAY: Automatically hide your screen from those beside you. The built-in privacy display can be preset¹ to turn on when receiving notifications, typing passwords, or using specific apps
- TYPE IT IN. TRANSFORM IT FAST: Enhance any shot in seconds on your smartphone by using Photo Assist² with Galaxy AI.³ Add objects, restore details, or apply new styles by simply typing or tapping
- NIGHTS, CAPTURED CLEARLY: From gigs to city lights, record and capture moments after dark with clarity using Nightography so your photos and videos stay crisp and clear on your Samsung Galaxy
- MAKE IT. EDIT IT. SHARE IT: Turn everyday moments into something personal with creative tools built right into your mobile phone, whether it’s a special contact photo, custom wallpaper, an invitation or more⁴
- HELP THAT KEEPS UP: Stay in the moment while Now Nudge with Galaxy AI helps you respond faster and stay organized with smart suggestions⁵ that appear exactly when you need them on your phone
Prevent unsafe intent redirection
Intent redirection occurs when an app launches an intent whose contents an outside party can influence, often through a nested intent extra or serialized intent string. Avoid a general-purpose “forward this intent” feature where possible. If forwarding is necessary, build a fresh destination intent from validated fields rather than passing through the received object. AndroidX Core 1.9.0 and later provides IntentSanitizer to allowlist intended components, actions, data, and extras; confirm the library version used by your project in the Android mitigation guidance.
- Constrain the destination to the expected package and component, and verify the resolved target before launching.
- Copy only fields your operation needs; do not retain arbitrary extras or selectors from an untrusted intent.
- Inspect URI permission flags before redirecting:
FLAG_GRANT_READ_URI_PERMISSION,FLAG_GRANT_WRITE_URI_PERMISSION,FLAG_GRANT_PERSISTABLE_URI_PERMISSION, andFLAG_GRANT_PREFIX_URI_PERMISSION. Do not pass grants onward unless required.
When another app needs to invoke an operation owned by your app, a carefully constructed PendingIntent can delegate that capability without asking the caller to supply an arbitrary intent.
Best Value
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Activating is easy, just 3 steps.
- ACTIVATION Promotion: Includes 1500 min, 1500 texts & 1500 MB Data + add more as you need it
- CAMERA SYSTEM: 50MP Quad Pixel camera. Capture sharper, more vibrant photos day or night with 4x the light sensitivity.
- PERFORMANCE: Blazing-fast Qualcomm performance. Get the speed you need for great entertainment with a Snapdragon 680 processor and 4GB of RAM.
- 64GB built-in storage. Get plenty of room for photos, movies, songs, and apps. Made for US
Construct service intents and PendingIntents safely
Use explicit intents when starting services, so the destination is specified rather than resolved from an implicit action. For PendingIntent, choose the creator method for the intended component type and use FLAG_IMMUTABLE by default. If a feature genuinely requires a mutable pending intent—for example, a system feature that fills in an inline reply—make its base intent explicit by component or package. An implicit mutable pending intent can allow another app to supply fill-in fields that redirect the eventual operation. See the Android intent documentation and PendingIntent security guidance.
Account for target SDK behavior
Platform delivery rules vary with the app’s target SDK. For apps targeting Android 13 (API level 33) or higher, external implicit intents delivered to exported components must match the declared filter’s action and category, subject to documented exceptions such as explicit intents, same-app calls, system-originated intents, and root. For apps targeting Android 14 (API level 34) or higher, implicit intents to internal app components are restricted; use an explicit intent for an unexported internal target, or intentionally expose a component if an external caller must invoke it. See the official Android 13 behavior changes and Android 14 behavior changes.
These platform checks complement application validation; they do not establish that an action’s data or extras are trustworthy. Record the target SDK and test the delivery behavior across the Android versions your app supports.
Quick Recap
Security review checklist
- Inspect every activity, service, receiver, and provider in the merged manifest.
- Set
android:exportedexplicitly; keep components private unless outside invocation is required. - Constrain exported interfaces with appropriate permissions where needed.
- Keep filters limited to required actions, categories, data, and MIME types.
- Validate action, URI, MIME type, extras, types, and ranges after delivery, including in
onNewIntent(). - Use explicit service intents and immutable
PendingIntentobjects unless a documented use case requires mutability. - Never forward an untrusted nested intent without sanitizing destinations, payload fields, and URI grant flags.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
