Android 12: Safer Component Exporting

1. Overview

Google introduced a new restriction on the component exporting in the Android 12 release as a behavioral change to improve the app’s safety. This restriction is an important change and will affect any apps targeting Android 12 and above.

Before moving on to this change, let’s understand the existing behavior of IntentFilter and android:exported tags.

2. Behavior prior to Android 12

If a component has an IntentFilter, then the Android framework automatically handles the attribute “android:exported=true” making it accessible to all other apps and the system.

Declaring an IntentFilter to an app component (Activities, services, and broadcast receivers) in the manifest file is enough to make your component accessible to all other apps installed on the device and to the Android system.

However, you could have explicitly specified the attribute “android:exported=false” to stop the component from being available or exported to other apps:

<activity android:name=".WebActivity"
          android:exported="false">
    <intent-filter>
        <action android:name="android.intent.action.VIEW"/>
        <category android:name="android.intent.category.DEFAULT"/>
        <category android:name="android.intent.category.BROWSABLE"/>
        <data android:scheme="http" android:host="tedblob.com"/>
    </intent-filter>
</activity>

3. Safer component exporting in Android 12 and above

From Android 12 and above, this is not the case anymore and you should add android:exported=true explicitly to make your app accessible to other apps or the system.

In the below code snippet, we have declared a launcher activity in the manifest file with no android:exported tag. If your target version is Android 11 or below, then this code would work fine, and can install the app on the devices.

<activity android:name=".MainActivity">
    <intent-filter>
        <action android:name="android.intent.action.MAIN" />
        <category android:name="android.intent.category.LAUNCHER" />
    </intent-filter>
</activity>

However, if your app target version is Android 12 or above, then this same configuration is not going to work and the app installation would fail.

You should add exported true explicitly to all components that have the IntentFilter and needs to be accessible from other apps.

Below are the errors or warnings you may experience on missing the exported true tag.

Android studio throws an installation error. Lint will also show a warning “When using intent filters, please specify the android:exported as well“. Error messages will differ based on the Android Studio version you are using.

Android Studio 2020.3.1 Canary 11 or later

Manifest merger failed: Apps targeting Android 12 and higher are required \ to specify an explicit value for android: exported when the corresponding \ component has an intent filter defined.

Android Studio 4.1.1

Installation did not succeed.
The application could not be installed: INSTALL_PARSE_FAILED_MANIFEST_MALFORMED
List of apks:
[0] '.../build/outputs/apk/debug/app-debug.apk'
Installation failed due to: 'null'
Retry

Older versions of Android Studio

If you attempt to install the app, Logcat displays the following error message:

Installation did not succeed.
The application could not be installed: INSTALL_FAILED_VERIFICATION_FAILURE
List of apks:
[0] '.../build/outputs/apk/debug/app-debug.apk'
Installation failed due to: 'null'

3.1. Fix

To fix, you must explicitly declare the android:exported=”true” attribute in the AndroidManifest file with the IntentFilter to export this launcher activity to the Android system or other applications.

<activity android:name=".MainActivity"
    android:exported="true">
    <intent-filter>
        <action android:name="android.intent.action.MAIN" />
        <category android:name="android.intent.category.LAUNCHER" />
    </intent-filter>
</activity>

If you are using any third-party libraries in your project, then there are good chances that it may not have android:exported true tag for the required components. In this case, upgrade to the latest library version that has the fix.

3.2. Debug the components missing the exported tag

To debug the component missing the exported tag, follow the below steps:

• Downgrade your sdk version to 30
• Rebuild your project
• After a successful build, open your AndroidManifest.xml file.
• Click on the Merged Manifest tab to see the final manifest file
• Check for any <activity> or android component that includes an <intent-filter> tag and is missing the android:exported attribute
• Fix them and upgrade back to SDK 31

You can also run this command from your Android studio gradlew processDebugAndroidTestManifest --debug. This would show detailed log messages in the console using which you can identify the components or libraries missing the exported tag.

4. Conclusion

In this article, we have gone through the safer component exporting change and its impact on Android 12 and above devices.

You can also refer to Android 12 documentation and our articles to know more about Android 12 behavioral changes.