Your app contains an Intent Redirection vulnerability

android-security
Ihsan Ali picture Ihsan Ali · May 16, 2019 · Viewed 10.2k times · Source

I launched a game to the Google Play store recently and it was going good until now. I just received an email from Google that says that "One or more of your apps contains an Intent Redirection vulnerability that puts user data at risk " and tells me I need to fix it by August 13.

I personally don't collect or demand any user data or info. However, I used Google Admob ads with Facebook mediation and Unity ads in my game which may be the cause of this problem. So, my question is how to overcome this problem? They also said in the email to make changes in the manifest file. If any one has a similar problem and knows the solution for it, your help would be appreciated.

Here is the email:

"One or more of your apps contains an Intent Redirection vulnerability that puts user data at risk. On August 13, 2019, any apps that contain unfixed security vulnerabilities beyond the dates listed on your Play Console alerts will be removed from Google Play.

Action required

Sign in to your Play Console. Select Alerts to see which apps contain a security vulnerability, and review the guidance on how to resolve the vulnerability. Update your affected apps to fix the vulnerabilities. Submit the updated versions of your affected apps. Upon resubmission, your app will be reviewed again. This process can take several hours. If the app passes review and is published successfully then no further action is required. If the app fails review then the new app version will not be published and you will receive notification via email."

Answer

Naeem Ibrahim picture Naeem Ibrahim · May 23, 2019

I have a same issue, actually Latest Unity Add Xiaomi SDK by default which cause this issue. enter image description here

Simple remove Xiaomi from your Unity it will fix the issue.

Related questions

What is AAPT (Android Asset Packaging Tool) and how does it work?

What does AAPT (Android Asset Packaging Tool) mean? How does it work? Can I ship the .so file of one application in the APK file of another application using AAPT?

Read More
Webview avoid security alert from google play upon implementation of onReceivedSslError

I have a link which will open in webview. The problem is it cannot be open until I override onReceivedSslError like this: @Override public void onReceivedSslError(WebView view, SslErrorHandler handler, SslError error) { handler.proceed(); } I am getting security alert from …

Read More
How to fix unsafe implementation of X509TrustManager in Android app

Google has advised that I have an unsafe implementation of the interface X509TrustManager in my Android application and need to change my code as follows: To properly handle SSL certificate validation, change your code in the checkServerTrusted method of …

Read More