为降低“任务劫持”的风险，本篇文档 建议更新应用的 AndroidManifest.xml 文件中的 allowCrossUidActivitySwitchFromBelow 属性：

<application android:allowCrossUidActivitySwitchFromBelow="false" >

然而，application标签文档 并未包含此属性。（这可能是一个隐藏属性。）

在 [ApplicationInfo] 的源代码中（链接）它写道

public boolean allowCrossUidActivitySwitchFromBelow = true;

这大概意味着默认值是 true，除非通过 Manifest 覆盖。

将此属性设置为 false 的利弊是什么？

可以通过 android:exported="false" 或 android:allowTaskReparenting="false" 来缓解“任务劫持”吗？

解决方案

What allowCrossUidActivitySwitchFromBelow actually does

This flag controls whether an activity from another UID (i.e., another app) that sits below yours in the same task stack is allowed to bring itself to the foreground.

• true (default)
  → Activities from other apps in the same task can resume / come to front.
• false
  → Prevents activities from different UIDs lower in the task from taking focus over your app。

This is specifically relevant to task hijacking / task affinity abuse, where another app inserts itself into your task and later surfaces unexpectedly.

Pros of setting it to false

1. Stronger protection against task hijacking

Prevents this pattern:

1. Malicious app joins your task (via shared taskAffinity or other tricks)
2. User leaves your app
3. Malicious activity resurfaces → impersonates your UI

Setting this to false blocks step #3.

2. Reduces UI spoofing risk

Especially important for:

• 登录界面
• 支付流程
• 敏感的用户输入

3. Safer task boundaries

It enforces a more intuitive rule:

“Only my app controls what appears on top of my task.”

Cons / Trade-offs

1. Can break legitimate cross-app flows

Some Android behaviors rely on shared tasks:

• Browser → app → browser flows
• OAuth / SSO flows
• Deep linking chains
• Apps that intentionally share taskAffinity

Setting this to false may:

• Prevent expected return navigation
• Cause unexpected task switching
• Break back stack continuity

2. Not officially documented / stable API

Since it's not part of the public manifest docs:

• Behavior could change across Android versions
• OEMs may ignore or modify it
• No compatibility guarantees

3. May cause subtle UX issues

Users might see:

• Duplicate tasks in recents
• Broken “Back” behavior
• Apps reopening instead of resuming