diff options
| -rw-r--r-- | CHANGELOG.md | 1 | ||||
| -rw-r--r-- | android/app/src/main/kotlin/net/mullvad/mullvadvpn/ui/MainActivity.kt | 3 | ||||
| -rw-r--r-- | android/config/config.mobsf | 3 |
3 files changed, 4 insertions, 3 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 4f0ae72831..1769d9b98f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -57,6 +57,7 @@ Line wrap the file at 100 chars. Th ### Security #### Android - Change from singleTask to singleInstance to fix Task Affinity Vulnerability in Android 8. +- Add protection against some tapjacking vulnerabilities. ## [2024.1-beta2] - 2024-02-19 diff --git a/android/app/src/main/kotlin/net/mullvad/mullvadvpn/ui/MainActivity.kt b/android/app/src/main/kotlin/net/mullvad/mullvadvpn/ui/MainActivity.kt index c7a9be2ff9..2bfe5d5d9d 100644 --- a/android/app/src/main/kotlin/net/mullvad/mullvadvpn/ui/MainActivity.kt +++ b/android/app/src/main/kotlin/net/mullvad/mullvadvpn/ui/MainActivity.kt @@ -65,6 +65,9 @@ class MainActivity : ComponentActivity() { setContent { AppTheme { MullvadApp() } } + // This is to protect against tapjacking attacks + window.decorView.filterTouchesWhenObscured = true + // We use lifecycleScope here to get less start service in background exceptions // Se this article for more information: // https://medium.com/@lepicekmichal/android-background-service-without-hiccup-501e4479110f diff --git a/android/config/config.mobsf b/android/config/config.mobsf index 0b00ae401a..5343cd2db3 100644 --- a/android/config/config.mobsf +++ b/android/config/config.mobsf @@ -21,8 +21,5 @@ # Sensitive screens currently prevent screenshots. - android_prevent_screenshot - # Will be investigate in the externally tracked issue DROID-529. - - android_tapjacking - # We've currently decided to support Android 8. - android_manifest_insecure_minsdk |