Apps with an exported content provider and no permission

What this finding means

A ContentProvider is Android's interface for sharing structured data between apps. Declaring one with android:exported="true" and no android:permission, readPermission or writePermission means any other installed app can issue queries against it without asking the user for anything.

Before Android 12 a provider with an intent filter was exported by default, which is how a great many of these reach production without a decision ever being made.

We have recorded this in 1,235 apps.

Why it matters

This is one of the oldest and most reliably exploited classes of Android data leak. A malicious app needs no permission and no user interaction; it queries the provider and reads whatever the provider returns. Where the provider wraps a database or the filesystem, a path-traversal in its URI handling can reach files the provider never intended to serve.

The severity depends entirely on what sits behind the provider, which static analysis cannot see. A provider over a public catalogue is uninteresting; one over a user's messages is serious.

How to fix it

• Set android:exported="false" unless another app genuinely needs the data. This is the correct answer for most providers.
• If it must be exported, require a signature-level permission so only your own apps can reach it.
• Scope android:grantUriPermissions narrowly and prefer per-URI grants over blanket access.
• Use <path-permission> to require a permission for the paths that need protecting, and remember that any path matching none of them falls back to the provider's own permission.
• Validate and canonicalise every URI the provider receives before resolving it to a file or a query.

How we detect it, and what it cannot tell you

The check reads the manifest. A provider is reported when it is exported, is not disabled, and carries none of the three permission attributes. Providers carrying <path-permission> children that require a permission are reported at a lower severity and titled differently, because access control was deliberately applied even though it does not cover every URI.

Attribution is the main caveat. Most exported providers in Android apps belong to libraries rather than to the app's own code — a share provider or an install referrer provider the developer never wrote. A provider class seen across several unrelated publishers is treated as vendor infrastructure and reported as a library artifact instead of counting against the app.