Testing Mobile IPC and Deep Links

Every exported component and registered URL scheme is a remote entry point that does not need the network. A malicious app on the same device — or a web page the user visits — can invoke them directly, and they are frequently written as if only the app itself would ever call them.

When to Use

• Reviewing AndroidManifest.xml for exported components
• Testing deep links, App Links, custom URL schemes, or Universal Links
• Assessing content provider and broadcast receiver exposure
• Checking PendingIntent, intent redirection, and App Group sharing
• Answering "what can another app on this device do to this one?"

When NOT to Use