I want to use meta-data in the Android manifest to customize the behavior of a service.
<service
android:name=".SampleService"
android:exported="false">
<meta-data
android:name="sampleName"
android:resource="@string/sampleValue" />
</service>
My service is part of a library, and it is possible some may put sensitive data into these attributes when they use my service. Are these meta-data attributes visible to other installed packages on the phone via the PackageManager even if the service is not exported?
Yes. Everything in the manifest, and everything in your resources and assets, is accessible to all applications on the device.