📌 1. Reporting information

• Name : Team Brrester

🧩 2. Overview of Vulnerabilities

• Vulnerability title: Task Hijacking vulnerability caused by inappropriate taskAffinity settings in the Realink Android app
• Date of discovery: 2025.06.08
• Discovery Location (URL or System Path) : AndroidManifest.xml
• Vulnerability type (CWE ID): CWE-284 (Improper Access Control)
• Vulnerability Description: Many activities in the Reolink Android app are set to launchMode= "singleTask", but you have not explicitly changed the taskAffinity attribute that specifies the task preference. This allows malicious apps to hijack the task of the Reolink app by using the same taskAffinity as the package name of the same Reolink app. If successful, a malicious app's screen will be displayed first when the user runs the normal Reolink app, which can lead to damage such as stealing user account information and obtaining malicious privileges.

🔍 3. Details

• Impacted Products/Services: Reolink App
• Influenced version of Android : On Android 10 and below
• Product version: 4.53.1.0.20250526
• Vulnerable components:
  • Activities set as launchMode="singleTask"in AndroidManifest.xml
  • If taskAffinity does not have an explicit setting
• attack vector:

This attack is carried out through a malicious application installed locally. The attacker exploits a configuration vulnerability in the AndroidManifest.xml of the reolink app to hijack the Task by displaying a crafted malicious Activity instead of the intended one when the user launches the legitimate app.

The key to the attack lies in the MainActivity settings within the AndroidManifest.xml file of the Realink app.

<activity
            android:name="com.android.bc.MainActivity"
            android:exported="true"
            android:launchMode="singleTask"
            android:screenOrientation="portrait"
            android:configChanges="screenSize|orientation|keyboardHidden"
            android:windowSoftInputMode="adjustPan|stateAlwaysHidden">
            <intent-filter>
                <action android:name="android.intent.action.VIEW"/>
                <category android:name="android.intent.category.DEFAULT"/>
                <category android:name="android.intent.category.BROWSABLE"/>
                <data android:scheme="@string/scheme_for_launch_app"/>
            </intent-filter>
        </activity>

The two conditions in the code are combined to create a vulnerability.