vetkit.android.manifest.weak-custom-permission
A custom Android permission uses the normal or dangerous protection level (or none, which means normal). Any app can obtain it, so it does not protect the components that require it.
Last updated:
Suite: Security
xml
A custom Android permission uses the normal or dangerous protection level (or none, which means normal). Any app can obtain it, so it does not protect the components that require it.
Category: SECURITY · Engine rule severity: INFO
How to fix it
Use android:protectionLevel="signature" for permissions that guard your own components.
References
Source: packages/engine/rules/sast/mobile.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.