关于Internal Test Track中应用更新因Intent Redirection Vulnerability遭拒的合规问题问询

Hey there, let’s tackle your two questions head-on, drawing from my hands-on experience navigating Google Play’s review policies and dealing with intent redirection issues:

Question 1: Does a rejected app update count as a violation? Is there a way to submit for review without negative consequences? #

First, let’s ground this in Google’s explicit statement from their email:

本次拒审不会影响您的Google Play开发者账号状态，但重复违规可能导致该应用或您的Google Play开发者账号被暂停。

This rejected update does not count as a formal violation right now. Google’s wording makes it clear this is a fixable issue with your current build, not a strike against your account.

As for a low-risk way to test your fixes:

• Use the Internal Test Track or Closed Test Track for your repair attempts. These tracks are designed for internal/limited testing, so their review process is more lenient, and rejected submissions here won’t leave a negative mark on your account.
• When submitting, make sure to add a detailed note in the "Review comments" section: list exactly what changes you made to address the intent redirection (e.g., "Added package restrictions to all outgoing implicit Intents" or "Implemented signature validation for incoming Intents"), and even attach logs or step-by-step validation proof if possible. This helps reviewers understand your efforts and speeds up the process.

Question 2: Can we keep trying to fix the issue via Internal Test Track without worrying about account suspension? #

From everything I’ve seen and the unwritten norms of Google Play’s policy, you absolutely can keep testing fixes in the Internal Test Track without account suspension risk.

Google’s account suspension rules target repeated, intentional violations in public-facing tracks (Production or Open Test Track). Internal Test Track submissions are meant for debugging and internal validation—even if you submit multiple flawed builds here, as long as you’re clearly working to fix the reported issue, Google won’t penalize your account.

That said, avoid pushing untested builds to Open Test or Production while you’re still troubleshooting—those tracks are subject to stricter enforcement, and repeated rejects there could start accumulating violations.

Quick Bonus Tip for Fixing Intent Redirection #

Since you mentioned Google’s support links didn’t give concrete fixes, here are actionable steps I’ve used to resolve similar issues:

• For outgoing Intents: Always specify a target package with Intent.setPackage() to prevent redirection to unintended apps. Avoid using broad implicit Intents without restrictions.
• For incoming Intents (if your app receives external Intents): Validate the calling app’s identity using getCallingPackage() or PackageManager.checkSignatures() to ensure only trusted apps can send Intents to your components.
• Use Google’s App Bundle Explorer to run pre-launch reports—this can flag potential intent redirection issues before you submit for review.

内容的提问来源于stack exchange，提问作者Ferhat Ergün