Question

I would like to know where the bundle “outState” of the method onSaveInstanceState(Bundle outState) is stored.

Is it stored in memory or in the device storage?

I am concerned about the security of the data which is stored in the bundle.

Answer 1

I don’t think there’s any way that any malicious background process can get at the bundle data of your application. It is not documented how Android treats the Bundle data. It may or may not be written to disk in the event that your app is cleaned, while backgrounded. However, given that we don’t know whether or not this data is saved to disk, and if it is, given that we have no clue where, and almost certainly don’t have read access to that part of the disk, I wouldn’t worry about some third party process being able to recover that data.

Consequently I’m not clear what you might think the exposure is. Though I may be missing something.
However, in answer to your question, it is absolutely in memory while your app is alive, and if your app is backgrounded it may or may not be written somewhere hidden, but we dont’ know because Google hasn’t told us.

It’s destroyed along with the application when the memory is collected.