<br />

**OWASP category:** [MASVS-PLATFORM: Platform Interaction](https://mas.owasp.org/MASVS/09-MASVS-PLATFORM)

## Overview

The [implicit intent](https://developer.android.com/guide/components/intents-filters#Types) hijacking vulnerability occurs when an application does
not specify a fully-qualified component class name or package when invoking an
intent. This allows a malicious application to register an intent filter to
intercept the intent instead of the intended application.

Depending on the intent content, attackers could read or modify sensitive
information or interact with mutable objects, such as [mutable](https://developer.android.com/reference/android/app/PendingIntent#FLAG_MUTABLE)
[PendingIntents](https://developer.android.com/reference/android/app/PendingIntent) or [Binders](https://developer.android.com/reference/android/os/Binder).

Hijacking an implicit intent can also allow an attacker to perform arbitrary
actions such as launching attacker-controlled components.

## Impact

If an implicit intent handling sensitive data passes a session token within an
extra URL string to open a WebView, any application specifying the proper intent
filters can read this token. This can allow any properly-configured application
on the device to intercept the intent and read the sensitive data within,
allowing attackers to exfiltrate data such as PII or session tokens.

## Mitigations

Unless the application requires it, make intents explicit by calling
`setPackage()`. This allows the intent to be interpreted only by a specific
component (either in-app or from other applications), preventing untrusted
applications from intercepting the data sent along with the intent. The
following snippet shows how to make an intent explicit:  

### Kotlin

    val intent = Intent("android.intent.action.CREATE_DOCUMENT").apply {
        addCategory("android.intent.category.OPENABLE")
        setPackage("com.some.packagename")
        setType("*/*")
        putExtra("android.intent.extra.LOCAL_ONLY", true)
        putExtra("android.intent.extra.TITLE", "Some Title")
    }
    startActivity(intent)

### Java

    Intent intent = new Intent("android.intent.action.CREATE_DOCUMENT");
    intent.addCategory("android.intent.category.OPENABLE");
    intent.setPackage("com.some.packagename");
    intent.setType("*/*");
    intent.putExtra("android.intent.extra.LOCAL_ONLY", true);
    intent.putExtra("android.intent.extra.TITLE", "Some Title");
    startActivity(intent);

If you need to use implicit intents, omit any sensitive information or mutable
objects that you don't want to expose. Implicit intents may need to be used when
an app does not have exact knowledge about which app will resolve the action
(e.g. composing an email, taking a picture, etc.).

## Resources

- [Manifest intent-filter element](https://developer.android.com/guide/topics/manifest/intent-filter-element)
- [Privileged Permission Allowlisting](https://source.android.com/devices/tech/config/perms-allowlist)
- [Intents and Intent filters](https://developer.android.com/guide/components/intents-filters)
- [Forcing chooser for implicit intents](https://developer.android.com/guide/components/intents-filters#ForceChooser)
- [Common implicit intents](https://developer.android.com/guide/components/intents-common)