Rule Definition
The attacks and consequences of improperly exporting a component may depend on the exported component: If access to an exported Activity is not restricted, any application will be able to launch the activity. This may allow a malicious application to gain access to sensitive information, modify the internal state of the application, or trick a user into interacting with the victim application while believing they are still interacting with the malicious application.

Remediation
Provide a permission with one of the following protectionLevel: - normal - dangerous - signature

Violation Code Sample

<activity 
    android:name="com.x8bit.bitwarden.PackageConfirmReceiver" 
    android:enabled="true" 
    android:exported="true" > 
    <intent-filter> 
        <action android:name="android.action.intent.MY_PACKAGE_CONFIM"/> 
        <category android:name="category" /> 
    </intent-filter> 
</activity>

Fixed Code Sample

1- Define permission in the top of the manifest file as following one 

<permission android:name="com.example.testapps.permission.ACTIVITY" android:protectionLevel="signature" /> 


2- Add the android:permission into service 

<manifest xmlns:android="http://schemas.android.com/apk/res/android" 
 package="com.example.testapps.test1"> 
 ... 
    <activity android:name=".MailListenerService" 
              android:permission= 
                 "com.example.testapps.permission.ACTIVITY" 
              android:enabled="true" 
              android:exported="true"> 
              <intent-filter></intent-filter> 
    </activity> 
  ... 
</manifest>

https://cwe.mitre.org/data/definitions/926.html