CWE-925, Improper Verification of Intent by Broadcast Receiver, is an Android weakness. The app uses a Broadcast Receiver that receives an Intent but does not verify the Intent came from an authorized source.
How it happens
Some intents, identified by action string, can only be broadcast by the operating system, for example a boot or battery event. MITRE explains the catch: when an app registers for these implicit system intents, it is also registered to receive explicit intents. A malicious app cannot send the implicit system intent, but it can send an explicit one straight to your receiver. If your code assumes any intent it gets is a real system one, the other app is now driving it.
// Vulnerable: acts on whatever arrives
public void onReceive(Context ctx, Intent intent) {
wipeLocalData(ctx);
}
// Safer: confirm the action is the expected system action
public void onReceive(Context ctx, Intent intent) {
if (!Intent.ACTION_BOOT_COMPLETED.equals(intent.getAction())) return;
startSync(ctx);
}
The observed examples show real impact. CVE-2025-20972 (details) was a mobile app store that did not verify the intent, allowing local attackers to write arbitrary files. CVE-2024-10576 was an application whose exposed broadcast receiver allowed local attackers to force a factory reset.
What an attacker gains
MITRE lists integrity impact and the ability to gain privileges or assume identity: another application can impersonate the operating system and make the software perform an unintended action.
How to find it
MITRE notes SAST can find some instances by following data flow. Review the manifest for each receiver, then read its onReceive method. Ask whether it checks the action, and whether the receiver is exported at all.
How to fix it
The MITRE mitigation is direct: before acting on the Intent, check the Intent action to make sure it matches the expected system action. Also consider limiting who can send to the receiver with a permission, and avoid exporting receivers that do not need to be reached from outside.
Quick check
If an app cannot send a system intent, how can it still attack the receiver?
It sends an explicit intent directly to the receiver. The receiver gets both kinds, so it has to check the action.
