is Firebase Messaging Service vulnerable to malicious Intent?

I found that FCM <service> declaration in AndroidManifest.xml is exported (by the <intent-filter>) but is not protected by any permission:

<service android:name=".firebase.MessagingService">
    <intent-filter>
        <action android:name="com.google.firebase.MESSAGING_EVENT" />
    </intent-filter>
</service>

But in GCM the service is protected (not exported, possibly started by an in-app broadcast receiver) (source).

I tried to send a custom Intent via adb shell am startservice to the messaging service, but nothing happened, maybe Google made their only protection against this, or perhaps I didn't do it right?

So I wonder if FCM is guaranteed to be immune of a malicious Intent attack? Is there any offical documentation/clarification on this?

is Firebase Messaging Service vulnerable to malicious Intent?

0 Answers