MASTG-TEST-0381 References to Insecure PendingIntent Creation (Android)

Platform: Android
Weakness: MASWE-0032
Weakness in the numbering of the MASWE beta: MASWE-0066
Profiles: L1 (basic security), L2 (advanced security)
Type: static
Best practices: MASTG-BEST-0063

Overview

This test checks for references to PendingIntent creation APIs to identify potentially insecure implementations. A PendingIntent wraps an Intent that will be executed later on behalf of the app's identity and permissions, making it critical to configure them securely.

PendingIntent objects can be obtained through these API methods:

PendingIntent.getActivity()
PendingIntent.getActivities()
PendingIntent.getService()
PendingIntent.getForegroundService()
PendingIntent.getBroadcast()

The primary security concerns when using PendingIntent are:

Mutability: A mutable PendingIntent allows the receiving app to modify the base intent's unfilled fields (action, data, categories, extras, etc.). This can enable malicious apps to redirect the intent to unintended components or inject malicious data. Use PendingIntent.FLAG_IMMUTABLE to prevent modification of the base intent. Note that prior to Android 12 (API level 31), PendingIntent objects were mutable by default, while since Android 12 (API level 31), the mutability of each PendingIntent object [must be specified](https://developer.android.com/guide/components/intents-filters#DeclareMutabilityPendingIntent "must be specified") using either FLAG_MUTABLE or the FLAG_IMMUTABLE flag.
Implicit Intents: Using an implicit base intent (without explicitly specifying the target component class) can allow malicious apps to intercept the PendingIntent and redirect its execution. An intent should use setClass(), setClassName(), or setComponent() to specify the target component explicitly.

For more details on PendingIntent security, refer to MASTG-KNOW-0024 and the Android security documentation on pending intents.

Steps

Run a static analysis tool (MASTG-TECH-0014) to identify all usages of:

PendingIntent.getActivity()
PendingIntent.getActivities()
PendingIntent.getService()
PendingIntent.getForegroundService()
PendingIntent.getBroadcast()

For each identified usage, check:

The flags parameter for the presence of FLAG_IMMUTABLE or FLAG_MUTABLE.
The base intent construction to determine if it is explicit (specifies target component) or implicit.

Observation

The output should contain a list of locations where PendingIntent creation APIs are used, along with the flags passed to the API (if identifiable) and whether the base intent appears to be explicit or implicit.

Evaluation

The test case fails if any of the following conditions are met:

A PendingIntent is created without FLAG_IMMUTABLE when the app's minSdkVersion is below 31, unless there is a specific need for mutability that is properly justified and the app takes other precautions.
A PendingIntent is created with FLAG_MUTABLE without a valid use case requiring mutability (e.g., inline reply actions).
The base intent is implicit (does not specify the target component using setClass(), setClassName(), or setComponent()), allowing potential hijacking by malicious apps.

Gekoppelde issues

Koppelingen
Koppelingstype	Issue
is related to	MASTG-BEST-0063 Use Immutable PendingIntents with Explicit Intents (Android)

OWASP -
EN: Publications of the OWASP Foundation, https://owasp.org/. OWASP® is a registered trademark of the OWASP Foundation, Inc.; GRCA is not affiliated with, nor endorsed by, the OWASP Foundation. Only the versions published by OWASP are authoritative.
- OWASP Application Security Verification Standard (ASVS) 5.0.0, May 2025, from OWASP/ASVS: © 2008-2025 The OWASP Foundation, licensed under CC BY-SA 4.0. Changes: divided into sections and converted into the GRCA format, the wording unchanged. These adaptations are shared under CC BY-SA 4.0 as well.
- OWASP Mobile Application Security Verification Standard (MASVS) v2.1.0, January 2024, from OWASP/masvs: © The OWASP Foundation, licensed under CC BY-SA 4.0. Changes: converted into the GRCA format, the wording unchanged. These adaptations are shared under CC BY-SA 4.0 as well.
- OWASP Mobile Application Security Weakness Enumeration (MASWE) v1.0.0, August 2026, from OWASP/maswe: © The OWASP Foundation, licensed under CC BY-SA 4.0. Changes: converted into the GRCA format, the wording unchanged, linked to the MASVS controls they map to. These adaptations are shared under CC BY-SA 4.0 as well.
- OWASP Mobile Application Security Testing Guide (MASTG) v2.0.0, June 2026, from OWASP/mastg: © The OWASP Foundation, licensed under CC BY-SA 4.0. The tests and best practices only, without code samples, images, tools or apps. Changes: converted into the GRCA format, the wording unchanged; references to other pages of the MASTG as links to mas.owasp.org; the weakness of each test in the numbering of MASWE v1 and linked to it. These adaptations are shared under CC BY-SA 4.0 as well.
- OWASP Software Assurance Maturity Model (SAMM) v2.2.0, July 2026, from owaspsamm/core: © The OWASP Foundation, licensed under CC BY-SA 4.0. Changes: converted into the GRCA format, the wording unchanged; short codes (G-SM-1-A) built from the model, the assessment questions as assessment procedures of their activities. These adaptations are shared under CC BY-SA 4.0 as well.
- OWASP Top 10:2025, from OWASP/Top10: © 2003-2025 The OWASP® Foundation, Inc., licensed under CC BY-SA 4.0. The ten categories, without the icons. Changes: converted into the GRCA format, the wording unchanged. These adaptations are shared under CC BY-SA 4.0 as well. The names of the mapped CWEs (Common Weakness Enumeration): © 2006–2026 The MITRE Corporation. License: The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. See the CWE Terms of Use. CWE™ is a trademark of The MITRE Corporation.
DE: Veröffentlichungen der OWASP Foundation, https://owasp.org/. OWASP® ist eine eingetragene Marke der OWASP Foundation, Inc.; GRCA steht in keiner Verbindung zur OWASP Foundation und wird von ihr nicht unterstützt. Maßgeblich sind allein die von OWASP veröffentlichten Fassungen.
- OWASP Application Security Verification Standard (ASVS) 5.0.0, Mai 2025, aus OWASP/ASVS: © 2008-2025 The OWASP Foundation, lizenziert unter CC BY-SA 4.0. Änderungen: in Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Diese Bearbeitungen stehen ebenfalls unter CC BY-SA 4.0.
- OWASP Mobile Application Security Verification Standard (MASVS) v2.1.0, Januar 2024, aus OWASP/masvs: © The OWASP Foundation, lizenziert unter CC BY-SA 4.0. Änderungen: in das GRCA-Format umgewandelt, der Wortlaut unverändert. Diese Bearbeitungen stehen ebenfalls unter CC BY-SA 4.0.
- OWASP Mobile Application Security Weakness Enumeration (MASWE) v1.0.0, August 2026, aus OWASP/maswe: © The OWASP Foundation, lizenziert unter CC BY-SA 4.0. Änderungen: in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den MASVS-Controls verknüpft, denen sie zugeordnet sind. Diese Bearbeitungen stehen ebenfalls unter CC BY-SA 4.0.
- OWASP Mobile Application Security Testing Guide (MASTG) v2.0.0, Juni 2026, aus OWASP/mastg: © The OWASP Foundation, lizenziert unter CC BY-SA 4.0. Nur die Tests und Best Practices, ohne Codebeispiele, Bilder, Werkzeuge und Apps. Änderungen: in das GRCA-Format umgewandelt, der Wortlaut unverändert; Verweise auf andere Seiten des MASTG als Links zu mas.owasp.org; die Schwachstelle jedes Tests in der Nummerierung der MASWE v1 und mit ihr verknüpft. Diese Bearbeitungen stehen ebenfalls unter CC BY-SA 4.0.
- OWASP Software Assurance Maturity Model (SAMM) v2.2.0, Juli 2026, aus owaspsamm/core: © The OWASP Foundation, lizenziert unter CC BY-SA 4.0. Änderungen: in das GRCA-Format umgewandelt, der Wortlaut unverändert; Kürzel (G-SM-1-A) aus dem Modell gebildet, die Assessment-Fragen als Prüfverfahren ihrer Aktivitäten. Diese Bearbeitungen stehen ebenfalls unter CC BY-SA 4.0.
- OWASP Top 10:2025, aus OWASP/Top10: © 2003-2025 The OWASP® Foundation, Inc., lizenziert unter CC BY-SA 4.0. Die zehn Kategorien, ohne die Symbole. Änderungen: in das GRCA-Format umgewandelt, der Wortlaut unverändert. Diese Bearbeitungen stehen ebenfalls unter CC BY-SA 4.0. Die Namen der zugeordneten CWEs (Common Weakness Enumeration): © 2006–2026 The MITRE Corporation. MITRE erlaubt die Nutzung für Forschung, Entwicklung und kommerzielle Zwecke, wenn jede Kopie den Urheberrechtsvermerk und die Lizenz enthält; maßgeblich ist der englische Wortlaut der Lizenz oben und die CWE Terms of Use. CWE™ ist eine Marke der MITRE Corporation.