Android

Security in Android tasks and activity flows

Intents, storage, permissions, WebView and inter-app communication.

Android components1 min readEditorial methods

Task stacks and activity launches affect which screen users see and in what context. Review more than the contents of individual screens.

Evaluation approach

Inspect launch modes, task relationships and external entry points. Check sensitive-screen session state through every route.

Application example

Open payments from notifications and other apps to check for stale account data. Include screens reached through Back navigation.

Limits and considerations

Misleading screen context can affect users even when the correct application is installed.

Building an entry-point matrix

The launcher, notifications, verified links and sharing from another application are separate starting paths. Check account and transaction context in each. A single-screen test can miss authorization differences between routes.

Checks and decisions

  • Map entry points
  • Test back stacks
  • Recheck sessions

Sources

The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.