---
title: Android Task Highjacking | Guardsquare
description: Learn about task hijacking attacks and discover their impact on mobile app security. Learn how to protect your mobile apps from task hijacking today.
---

[![guardsquare-logo](https://insights.guardsquare.com/hs-fs/hubfs/Logos/logo-white.png?length=536&name=logo-white.png "guardsquare-logo") ](https://23593082.hs-sites.com/)

- pricing

[Request Pricing](https://www.guardsquare.com/request-pricing?hsCtaTracking=646b0379-d596-4b1a-8526-2ccbdbb0f81b%7Ce8809087-a83f-4476-8b22-34b9572013fd)

[Login](https://customers.guardsquare.com/login?utm_referrer=https%3A%2F%2Fwww.guardsquare.com%2F)

En

- [中文](https://www.guardsquare.com/zh-hans)
- [한국어](https://www.guardsquare.com/ko)
- [Português](https://www.guardsquare.com/pt-br)
- [Español](https://www.guardsquare.com/es)

# [Mobile Application]

# Security Research Center

 Table of contents

# Android task hijacking

Android task hijacking allows a malicious app to inherit the identity of a victim app to execute phishing attacks on users. A fake activity is displayed instead of the real one, which allows the attacking malware to gain access to the users' data.

Task hijacking attacks are similar to [UI injections](https://23593082.hs-sites.com/knowledgebasetest/attacks/overlay-attacks) because they also rely on malicious activities that imitate the real application activities. The difference is that in case of task hijacking, the malicious activity is displayed not on top of the original activity, but instead of the original activity. The malicious activity is added to the original task, which makes it very hard to detect by an unsuspecting user.

Examples of task hijacking attacks are:

- [Task affinity vulnerability](https://developer.android.com/privacy-and-security/risks/strandhogg) aka StrangHogg attack. Applies for API Level < 30 (Android < 11).
- [`Context.startActivities()` hijack](https://nvd.nist.gov/vuln/detail/CVE-2020-0096) aka StrandHogg 2.0 attack Applies for API Level < 29 (Android < 10).

## Defense techniques

 --- title: Task hijacking attacks --- graph TD all[All malware attacks] --> steal_screen click all href "https://23593082.hs-sites.com/knowledgebasetest/malware/overview" "Malware overview" steal_screen[Spy on users' screen] steal_screen --> task[Task hijacking] task --> task_api30{API Level ≥ 30?} task_api30 -- Yes (Android 11+) --> no_need[No need for protection] task_api30 -- No --> task_api29{API Level ≥ 29?} task_api29 -- Yes (Android 10+) --> solutions29([Solutions]) solutions29 --> task_affinity([taskAffinity]) solutions29 --> num_act([numActivities ⭐]) task_api29 -- No --> solutions28([Solutions]) solutions28 --> num_act solutions28 --> single_instance([Single instance launch]) style no_need fill:lightgreen style task_affinity fill:lightgreen style num_act fill:lightgreen style single_instance fill:lightgreen click single_instance href "https://23593082.hs-sites.com/knowledgebasetest/defense/task-hijacking-single-instance" "Single instance" click task_affinity href "https://23593082.hs-sites.com/knowledgebasetest/defense/task-hijacking-empty-affinity" "Empty task affinity"

 

## [Guardsquare](https://23593082.hs-sites.com/knowledgebasetest/author/guardsquare)

Connect with the author

** Table of contents **

![HubSpot CMS](https://cdn2.hubspot.net/hubfs/302335/hubspot-cms-logo-gray.svg "HubSpot CMS")

[General Terms](https://23593082.hs-sites.com/terms-of-use) | [Privacy Policy](https://23593082.hs-sites.com/privacy-policy) | [Cookie Policy](https://23593082.hs-sites.com/cookie-policy)

Tervuursevest 362 bus 1, 3000 Leuven, Belgium | VAT: BE0550675829 |

© 2016-2026 Guardsquare nv. All rights reserved.

<https://www.facebook.com/guardsquare> <https://twitter.com/Guardsquare> <https://www.linkedin.com/company/guardsquare/> <https://www.youtube.com/channel/UCP9s5F1ksT1E-7vSF2CDyhw> <https://github.com/Guardsquare>

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Guardsquare",
    "url" : "https://23593082.hs-sites.com/knowledgebasetest/author/guardsquare"
  },
  "dateModified" : "2024-02-28T02:07:56.868Z",
  "datePublished" : "2024-02-15T20:00:04.000Z",
  "headline" : "Android Task Highjacking | Guardsquare",
  "mainEntityOfPage" : {
    "@id" : "https://23593082.hs-sites.com/knowledgebasetest/attacks/task-hijacking-attacks",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject"
    }
  }
}
```