Differentiate implicit broadcast receiver vs explicit broadcast receiver in the manifest

But how do we recognise if a receiver is implicit?

If the Intent has a ComponentName, the Intent is explicit. Otherwise, it is implicit.

That ComponentName can be obtained in one of a few ways, including:

• It can be directly put on the Intent (e.g., new Intent(this, TheReallyAwesomeReceiver.class)

• It can be directly put on the Intent after using PackageManager and queryIntentReceivers() to find the right one based on action strings, etc.

• It can be derived by the system from the action string, etc. plus the package defined via setPackage()

Should we look only at the "action" tag and see if it is whitelisted to keep it in the manifest?

No. You also need to think about the nature of the broadcast: is it going to any registered receiver, or only to a specific app?

For example, the "com.android.vending.INSTALL_REFERRER" intent is not whitelisted. Should we register it in an Activity?

No. That broadcast will only go to the app that was recently installed, and so it must be an explicit Intent. The action string and such are there to help the system determine which of your registered receivers is the relevant one.

Contrast that with ACTION_PACKAGE_ADDED. That is broadcast to any registered receiver; it is not going to just one specific app. Hence, that Intent must be implicit (as otherwise it would have a ComponentName identifying a specific receiver in a specific app). And, since ACTION_PACKAGE_ADDED is not on the whitelist, the assumption should be that you cannot register for this broadcast in the manifest on Android 8.0+.