[Android] StoragesMonitor: stop exporting the receiver

[Duncan McNamara]

vlc-android | branch: master | Duncan McNamara <dcn.mcnamara at gmail.com> | Wed Aug 19 15:38:26 2026 +0200| [a2ed9b081dabe78a9f17e10fff31522c7de5e4da] | committer: Nicolas Pomepuy

StoragesMonitor: stop exporting the receiver

Block explicit-intent attacks on StoragesMonitor.
MEDIA_MOUNTED/REMOVED are protected broadcasts, so
the OS still delivers them with exported=false.

> https://code.videolan.org/videolan/vlc-android/commit/a2ed9b081dabe78a9f17e10fff31522c7de5e4da
---

 application/vlc-android/AndroidManifest.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/application/vlc-android/AndroidManifest.xml b/application/vlc-android/AndroidManifest.xml
index 4f89a1b1cf..622f418582 100644
--- a/application/vlc-android/AndroidManifest.xml
+++ b/application/vlc-android/AndroidManifest.xml
@@ -1158,7 +1158,7 @@
         <receiver
             android:name=".StoragesMonitor"
             android:enabled="false"
-            android:exported="true">
+            android:exported="false">
             <intent-filter>
                 <action android:name="android.intent.action.MEDIA_MOUNTED"/>
                 <action android:name="android.intent.action.MEDIA_REMOVED"/>