Android: Visibility and accessibility of exported components

In Android development, android:exported is an attribute used to define whether a component (such as Activity, Service, BroadcastReceiver, ContentProvider, etc.) can be accessed by other applications. In the AndroidManifest.xml file, use the android:exported attribute in the <activity>, <service>, <receiver>, <provider> tags to define the visibility and accessibility of the component.

 <activity android:name=".activity.GuideActivity" android:exported="true" android:launchMode="singleTop"> <intent-filter> <action android:name="android.intent.action.MAIN" /> <category android:name="android.intent.category.LAUNCHER" /> </intent-filter> </activity>

android:exported is true:

• Components can be accessed by other applications.
• Other applications can start this Activity, send broadcasts to this BroadcastReceiver, or bind to this Service.
• For some components (such as Activities), if android:exported is not explicitly set, the default value may be true, depending on the Android version and component type.

android:exported is false:

• A component can only be accessed by the application that defines it.
• Other applications cannot access this component directly.
• Improved security and reduced potential attack surface.

Starting with Android 12 (API level 31), the system begins to check the value of android:exported more strictly. If the system detects that a component's android:exported value does not match its functionality (for example, an implicit Intent can start an Activity that is not declared exported=true), or binds to a Service that is not declared exported, the app may crash or encounter other problems at runtime. To ensure the stability and security of your app, you should explicitly set the value of android:exported and make sure it matches the actual purpose of the component.