I'm starting android bug hunting and I've seen a service with implicit intent, and I saw in Android documentation that :

Using an implicit intent to start a service is a security hazard because you cannot be certain of the service that responds to the intent

The service is derivated from FirebaseMessagingService. I would like to know if this is a security issue and If it is what would be the impact ?



The extension of FirebaseMessagingService is usually used to process the notification messages when the application is in foreground. The processing is automatically done by the system when the application is in background. Based on my research and understanding, this service is started by the system and once the notification message is received the onMessageReceived() is invoked. In this case, I don't see usage of implicit intent for invoking a service as a security issue. Also, as per the official documentation, to use this functionality the service is to be declared in the manifest in the predefined way which seems to be a functional requirement.

Recommended Read: https://medium.com/@MiBLT/mastering-firebase-notifications-36a3ffe57c41

PS: While answering the question, I'm assuming that you are performing bug hunting on the Android application using Firebase component and not the component itself.

  • Thank you for your answer, I'll look at the whole documentation to learn more about it but the medium blog post is pretty useful thanks ! Yes i'm starting bug hunting on android application and not firebase component itself. Have a nice day and thank you ! – Neolex Jun 19 '19 at 10:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.