End user bug reports

Vendors should monitor end user native crash reports. Memory safety bugs should be treated with urgency as they most often represent an exploitable vulnerability or user visible instability. The Android OS manages bug reports using the DropboxManager, which broadcasts the ACTION_DROPBOX_ENTRY_ADDED intent when a crash occurs.

Vendors should implement a system app that listens for these broadcasts, using BroadcastReceiver and retrieve the crash reports from the DropboxManager. These should be sent to the vendor's servers for analysis.

Google implements such a mechanism in Google Play Services and monitors bugs from end user devices. Where permitted by applicable legal and privacy standards, Google may share a subset of the most frequently occuring bugs with vendors. However, only a subset of crashes may be shared, and Google strongly recommends that vendors should be implementing their own end user bug tracking as described above.