[Android] Remote Access: stop exporting the control service

[Duncan McNamara]

vlc-android | branch: master | Duncan McNamara <dcn.mcnamara at gmail.com> | Wed Sep 23 13:50:45 2026 +0200| [e689c2f9ee3ca0b81c277c62ceb88e7e75359b81] | committer: Nicolas Pomepuy

Remote Access: stop exporting the control service

Remote Access could be started by any app with no permissions,
bypassing the disabled toggle in Settings.

Stop exporting the service, and bail out in onCreate() if the
feature isn't enabled, as a second line of defense.

> https://code.videolan.org/videolan/vlc-android/commit/e689c2f9ee3ca0b81c277c62ceb88e7e75359b81
---

 application/remote-access-server/src/main/AndroidManifest.xml       | 2 +-
 .../java/org/videolan/vlc/remoteaccessserver/RemoteAccessService.kt | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/application/remote-access-server/src/main/AndroidManifest.xml b/application/remote-access-server/src/main/AndroidManifest.xml
index b29664887c..a8f5d1feb3 100644
--- a/application/remote-access-server/src/main/AndroidManifest.xml
+++ b/application/remote-access-server/src/main/AndroidManifest.xml
@@ -29,7 +29,7 @@
     <application>
         <service
                 android:name=".RemoteAccessService"
-                android:exported="true"
+                android:exported="false"
                 android:foregroundServiceType="specialUse">
             <property
                     android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
diff --git a/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/RemoteAccessService.kt b/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/RemoteAccessService.kt
index 6aa176e11d..f333d9d4cf 100644
--- a/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/RemoteAccessService.kt
+++ b/application/remote-access-server/src/main/java/org/videolan/vlc/remoteaccessserver/RemoteAccessService.kt
@@ -125,6 +125,12 @@ class RemoteAccessService : LifecycleService(), CoroutineScope by MainScope() {
         super.onCreate()
         if (AndroidUtil.isOOrLater) forceForeground()
            lifecycleScope.launch(Dispatchers.IO) {
+               if (!Settings.getInstance(this at RemoteAccessService)
+                       .getBoolean(KEY_ENABLE_REMOTE_ACCESS, false)
+               ) {
+                   withContext(Dispatchers.Main) { stopSelf() }
+                   return at launch
+               }
                server = RemoteAccessServer.getInstance(applicationContext)
                if (!Settings.getInstance(this at RemoteAccessService)
                        .getBoolean(KEY_REMOTE_ACCESS_LAST_STATE_STOPPED, false)