One of the major changes to Android 12 is to improve application and system security, and this change affects all apps targeted for Android 12.

Activities, services, and broadcast receivers registered in the Androidmanifest.xml file with intent-filter declarations must explicitly state whether the service needs to be disclosed (android: exported).

❗️ If your application has the following error message, it is most likely related to this change.

Installation did not succeed.

The application could not be installed: INSTALL_FAILED_VERIFICATION_FAILURE

List of apks:

[0] ‘… / build/outputs/apk/debug/app – debug. Apk ‘

Installation failed due to: ‘null’

or

NSTALL_PARSE_FAILED_MANIFEST_MALFORMED: Failed parse during installPackageLI:

/ data/app/vmdl538800143. TMP/base. The apk (at Binary XML file line #…). :

com.example.package.ActivityName: Targeting S+ (version 10000 and above) requires that an explicit

Value for Android: Exported be defined when intent filters are present”

The solution

To solve the above problem, you need to create the androidmanifest.xml file, Declare android: Exported attributes for

,

,

, or < Receiver > components that use

.



We look forward to receiving your feedback on this requirement, and if you have any suggestions or thoughts, please fill out this short questionnaire to give us feedback, telling us which use cases in your application are affected by this change.

Android: Exported =”true” ⚠️ Do not add android: Exported =”true” to any of these components. You need to check and consider components that have the Intent-filter attribute added: Does this component need to be enabled by any other application on the user’s device?

Determining whether a component can call or interact with components or services of other applications depends on the functionality of the application itself, how other applications interact with the application, and the specific application scenarios that may exist. Here are some common examples of recommended intent-filter configurations and why.

To include the category of the android: name = “android. Intent. The category. The LAUNCHER” / > Activity set android: exported = “true”

The Activity may be the MainActivity of your application. Since the Android Launcher is a conventional application, the Activity must be set to exported=”true”. Otherwise, the application Launcher won’t start it.

To include < action android: name = “android. Intent. Action. VIEW” / > Activity set android: exported = “true”

This Activity handles “open with” operations from other applications.

To include < action android: name = “android. Intent. Action. SEND” / > or < action android: name = “android. Intent. Action. SEND_MULTIPLE” / > Android: Exported =”true”

This Activity handles content shared from other applications. For more information, see receiving Simple Data from Other Applications.

To include < action android: name = “android. Media. Browse. MediaBrowserService” / > Service set android: exported = “true”

If this is a Service that exposes an application’s media library to other applications, it needs to be set to Android: Exported =”true” for other applications to connect to and browse. This Service is generally accomplished by direct or indirect inheritance MediaBrowserServiceCompat, if not, there is no need to set this.

To include < action android: name = “com. Google. Firebase. MESSAGING_EVENT” / > Service set android: exported = “false”

This Service is called by Firebase Cloud Messaging, and the Service needs to inherit from Firebase EmessagingService. Android: Exported =”true” should not be set to android: Exported =”true” because Firebase can start this Service regardless of its attribute value. For more information, see developing a Firebase Cloud-based messaging application on Android.

To include < action android: name = “android. Intent. Action. BOOT_COMPLETED” / > Receiver set android: exported = “false”

Exported or not, the system sends a corresponding broadcast to the receiver.

background

Prior to Android 12, components with intent-filter attributes (only activities, Services, and BroadcastReceivers) are automatically set to exported by default.

The following activities will be exported by default:

<activity android:name=".MainActivity">
    <intent-filter>
        <action android:name="android.intent.action.MAIN" />
        <category android:name="android.intent.category.LAUNCHER" />
    </intent-filter>
</activity>
Copy the code

The following activities will not be exported:

<activity android:name=".MainActivity" />
Copy the code

This default setting may seem reasonable, but this error could leave the application vulnerable. For example, suppose our app has an Activity that plays a video:

< the activity of the android: name = ". PlayVideoActivity "/ >Copy the code

Later, we found that many places require the Activity to be explicitly called or started. To reduce application coupling, we added the Intent-filter attribute to the Activity to allow the system to select the Activity:

<activity android:name="PlayVideoActivity".>
    <intent-filter>
        <action android:name="Android. Intent. Action. The VIEW" />
        <data
            android:mimeType="Video / *"
            android:scheme="Content" />
    </intent-filter>
</activity>
Copy the code

This is where the problem arises. The Activity was designed only for use inside the app, but now it’s exposed!

If the target version of our application is Android 12, the system will prevent this setting and force us to set the Android: Exported attribute. Since we don’t want to expose the Activity to the outside world, we can set Android :export=false to ensure the security of the application.

<activity
    android:name="PlayVideoActivity".
    android:exported="False">
    <intent-filter>
        <action android:name="Android. Intent. Action. The VIEW" />
        <data
            android:mimeType="Video / *"
            android:scheme="Content" />
    </intent-filter>
</activity>
Copy the code

Brief summary

One important change in Android 12 is improved security. Android 12 targeted version of the app, If the activity, activity-alias, service, or broadcast receiver registered in androidmanifest.xml has an intent-filter attribute, The Android: Exported value must be explicitly set otherwise the application will not install.

The Android: Exported attribute needs to be carefully considered. If you are not sure, android:exported=”false” is recommended.

To learn more about intents and intent-filters, see Receiving an implicit Intent.

For more security and privacy updates, see: Behavior Change: Apps for Android 12 -> Security.

For all the updates to Android 12, see: First Developer preview of Android 12 arrives.