Android Legacy Security Standards

Priority: P0 (CRITICAL)

1. Secure Intents and Components

• Set android:exported="false" for all internal Activities/Services unless needed for deep links.
• Verify resolveActivity before starting implicit intents.
• Treat all incoming Intent extras as untrusted — validate all schema/data types.

See hardening examples for manifest and component restrictions.

2. Lock Down WebViews

• Default to javaScriptEnabled = false. Use WebViewClient and WebChromeClient to restrict navigation.
• Disable allowFileAccess and allowFileAccessFromFileURLs to prevent local file theft via XSS.
• If using @JavascriptInterface (API 17+), strictly limit exposed API surface.

See hardening examples for WebView lockdown patterns.