Android Manifest Reviewer

An exported launcher can be intentional

The sample activity is exported because it is the app launcher. Exported does not automatically mean vulnerable. Other exported entry points may require permissions, caller checks or narrower intent handling. Those behaviours often live in code and cannot be proven from XML alone.

Target SDK changes the interpretation

Android has changed component and network defaults over time. For apps targeting Android 12 or later, activities, services and receivers with intent filters need an explicit exported declaration. Build tooling can supply SDK values and merge library declarations, which is why the optional target field must reflect the actual build.

Follow referenced configuration

A networkSecurityConfig reference points to another resource the reviewer has not read. Backup rules can also live in separate files. The tool will identify the boundary instead of claiming to have inspected those resources. Review them in your project and test the resulting release build.

XML review is one part of app review

This utility does not decompile APKs, connect to a phone, test certificate trust or inspect runtime permission handling. It rejects document type declarations and entity definitions. Its output is a set of static review points, not certification that an Android app is safe.

References

• Android application manifest reference
• Android activity and exported behaviour
• Manifest merging and build configuration
• Runtime permission requests, Android

Documentation reviewed: 1 November 2026. Rule results describe the supplied text, not a live application test.

Useful next steps

• Secret Redactor
• Security Report Builder
• Practical guides and coding projects

Maintained by MetaCyberGuru. A review point may need source, runtime or deployment context before you act on it.