Receiving a broadcast does not make its content trustworthy. Receivers that initiate sensitive work need source and authorization checks.
Evaluation approach
Separate system broadcasts from application-specific messages. Assess registration, export status and permissions for supported Android versions.
Application example
Check that arbitrary input to a session-refresh receiver cannot change the selected account or elevate access through failure handling.
Limits and considerations
An unpredictable action name is not access control.
Why background behavior matters
Test background execution, restarts and account switching as well as foreground use. A delayed message for an old account must not initiate work under a new account.
Checks and decisions
- Inventory receivers
- Document source requirements
- Reject unexpected fields
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.