INSTALL_REFERRER is an Android broadcast intent used to pass install attribution information to an app after installation. It lets an application read referral data from the installation flow, and because it is broadcast-based, the data should be treated as untrusted input and validated before use.
What INSTALL_REFERRER Is and Why It Matters
INSTALL_REFERRER is not a trusted identity signal just because it arrives after install. It is a broadcast-delivered attribution value, so apps should treat it as input data, not proof of source, campaign integrity, or user intent.
The security relevance is straightforward: any broadcast-fed value can be forged, replayed, or malformed unless the receiving app validates it. That means INSTALL_REFERRER is useful for marketing attribution and onboarding flows, but unsafe as a sole basis for access decisions, trust decisions, or data routing.
How INSTALL_REFERRER Is Delivered on Android
Android delivers INSTALL_REFERRER as a broadcast intent after installation, which makes it part of the app’s startup and attribution path rather than a protected application state. In practical terms, the app receives referral data asynchronously and must assume the payload may be incomplete, altered, or absent.
Because broadcast delivery is not equivalent to authenticated delivery, the app should not assume the referrer originated from a particular store, installer, or campaign system. Defensive handling means parsing conservatively, rejecting unexpected formats, and avoiding privileged behavior until the value is verified by a stronger signal.
Security Implications of Untrusted Referral Data
The main risk is trust abuse. If an app uses INSTALL_REFERRER for entitlement changes, analytics billing, deep-link routing, or environment selection without validation, a malicious actor can feed the app misleading attribution data and steer downstream logic.
That can create integrity issues rather than classic compromise, but the impact can still be significant. False attribution can corrupt measurement, trigger unsafe code paths, weaken fraud controls, or cause the app to grant attention, content, or workflow access based on a value it should never have treated as authoritative.
For a broader control lens, Android and mobile app hardening guidance such as NIST SP 800-53 Rev 5 Security and Privacy Controls and OWASP API Security Top 10 both reinforce the same principle: treat externally supplied input as untrusted until validated and constrained.
Validation, Fallbacks, and Safer Attribution Design
INSTALL_REFERRER is best used as a weak hint, not a source of trust. Robust designs cross-check it against server-side attribution, signed campaign parameters, or installer-confirmed telemetry before making business decisions that matter.
Where the value is missing or suspicious, the safer choice is to degrade gracefully and preserve normal app function. This avoids turning attribution metadata into a single point of failure, and it keeps malformed or attacker-controlled input from influencing security-sensitive logic.
Practical handling also includes canonicalising the value, enforcing expected length and character rules, and separating analytics attribution from any user-facing or security-sensitive action. For Android teams that want a broader hardening baseline, CIS Benchmarks are useful for the surrounding platform configuration, while the app itself still needs explicit input validation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | INSTALL_REFERRER is untrusted input that must be validated before use. |
| Recommendation — Validate referral data before it influences attribution, routing, or any security-sensitive decision. | ||
| OWASP API Security Top 10 | API8 — Security Misconfiguration | Broadcast-fed attribution depends on safe exposure and strict input handling in the app flow. |
| Recommendation — Harden the receiver path so broadcast inputs cannot trigger unsafe default behavior. | ||
| CIS Controls v8 | CIS-16 — Application Software Security | Mobile app code handling INSTALL_REFERRER needs secure input handling and safe control flow. |
| Recommendation — Review app code paths that consume referrer data and remove trust assumptions from them. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org