auditing-android-intent-redirection-and-pendingintentlisted

# Auditing Android intent redirection and PendingIntent: when an app relays an attacker's intent An Android app acts on intents, and two patterns let an untrusted caller borrow the app's privilege. In intent redirection, a component receives an intent that carries another intent inside it and then launches that nested intent; if the component is reachable by other apps and forwards the nested intent without constraint, an untrusted caller supplies an intent aimed at a protected component the caller could not reach directly, and the privileged app launches it with the app's own identity. In the pending-intent case, the app creates a token that lets another app perform an operation as the app later; if that token is mutable and under-specified, the other app fills in the missing parts, target, action, or data, and directs the operation where it wants, still under the app's identity. In both, the app relays an attacker's intent and lends its privilege to the destination. The bug is a privileged component launching or sending an intent an untrusted caller controls. You audit these by finding every forwarded and shared intent and checking what the caller can steer. ## When to use - An Android app forwards an intent it extracts from a received intent's extras or data. - The app creates pending intents shared with other apps or delivered implicitly. - A reachable component launches or sends intents on behalf of its caller. ## Scope check Audit intent redirection only on apps an