Repository navigation
[Question]: android:exported="true" flag #2540
Description
How can we help?
Hey everyone! Hope the message finds you well.
I'm inquiring about a topic that was mentioned in an issue closed some time ago, that as mentioned in the last comment, has resurfaced: #1135 (comment)
With regards to two specific components that are marked as exported in the SDK's Manifest: com.onesignal.NotificationOpenedActivityHMS and com.onesignal.notifications.activities.NotificationOpenedActivity. It's not clear to me why do these components need to be exported.
At least for NotificationOpenedActivity I tested replacing it as android:exported="false" in the merged manifest in an application, and it still works fine across different Android versions (tested 9, 12, and 16), which makes sense if the one place it is called is inside the SDK - in which case it wouldn't need to be exported. But I wanted to get confirmation from the OneSignal devs before making this change in the app, to avoid unforeseen issues.
Let me know if you need any more information, thank you!
Code of Conduct
- I agree to follow this project's Code of Conduct
Activity
abdulraqeeb33 commentedon Aug 5, 2026
Thanks for raising this, and for the investigation on
NotificationOpenedActivity!This has been addressed in #2659 and shipped in 5.9.8.
Summary
Several notification components that are only invoked via app-created
PendingIntents or protected system broadcasts no longer need to be externally launchable. In 5.9.8+, the following are nowandroid:exported="false":com.onesignal.notifications.activities.NotificationOpenedActivitycom.onesignal.notifications.activities.NotificationOpenedActivityAndroid22AndOldercom.onesignal.notifications.receivers.NotificationDismissReceivercom.onesignal.notifications.receivers.BootUpReceivercom.onesignal.notifications.receivers.UpgradeReceiverWhy HMS remains exported
com.onesignal.NotificationOpenedActivityHMSis stillandroid:exported="true"because HMS Core launches it cross-UID for Huawei notification opens. That path requires the activity to remain exported.FCMBroadcastReceiveralso remains exported, and continues to be protected bycom.google.android.c2dm.permission.SEND.Recommendation
Please upgrade to OneSignal Android SDK 5.9.8+. After upgrading, you should no longer need a merged-manifest override to set
NotificationOpenedActivitytoexported="false".Closing this as fixed. Feel free to reopen if you still see issues on 5.9.8+.