Home / Vulnerability Database / Android : Unsafe StickyBroadcast
Android

Android : Unsafe StickyBroadcast

Overview

The application uses sticky broadcasts. Such broadcasts are not compatible with the permission mechanism and are available to any receiver. Sticky broadcast is deprecated since API Level 21 and is not recommended for use.

Sticky broadcasts were used to ensure that the application that registered the message receiver of a certain type could get even those messages that were sent when the application had not been launched yet. This mechanism was used, for example, for the application to be able to get a message about the current battery level after launching: this information was distributed through sticky broadcasts. However, the broadcasts of this type do not provide security: any application has access to them. Therefore, starting with API Level 21, creating custom sticky broadcast is not recommended. To notify the application that some event has occurred, it is recommended to use regular broadcasts; to notify the application about the current state of the system, it is recommended to use other mechanisms. For example, the information about the current battery level can be obtained via batteryStatus.getIntExtra(BatteryManager.EXTRA_LEVEL, -1) and batteryStatus.getIntExtra(BatteryManager.EXTRA_SCALE, -1).

MEDIUM

DerScanner Severity Score

Do you want to fix Android : Unsafe StickyBroadcast in your application?

See also

Android

Android : Debug mode on

Android

Android : Error handling: generic exception

Android

Android : HTTP usage