android-intent-security

Validate any nested Intent before launching it: verify the target package matches your app, confirm the target component is exported, and strip URI permission grant flags. With AndroidX Core 1.9.0+, use IntentSanitizer with an explicit allowlist of components, actions, and extras.

Use PendingIntent.FLAG_IMMUTABLE by default for alarms and notifications. Only use FLAG_MUTABLE when required, such as inline notification replies, and always set an explicit target component on the base Intent to prevent hijacking.

Retrieve the calling UID with Binder.getCallingUid(), resolve it via PackageManager.getPackagesForUid(), and verify the caller's signing certificate with hasSigningCertificate. Perform this check inside each Binder transaction method, not in onBind, since binder connections are cached.

IntentSanitizer requires AndroidX Core 1.9.0 or higher as a library dependency and works at the app level regardless of device API. Without it, you must manually verify the nested Intent's target package and exported status before launching.

This guidance covers only local inter-component and inter-app communication security on Android. It does not address network security, web integration, or host-to-server security, which require separate hardening practices.