Tapjacking

Tapjacking is an attack vector where a user is tricked into selecting a security-relevant control from an overlay that obscured the intended button. For more information, refer to Android Developer documentation.

To prevent tapjacking, App Shielding can be configured to block all inputs to the application when a non-system overlay is detected on the screen. For Android 12 and later , this configuration also blocks and removes non-system overlays when the protected app is running. However, if your app uses a legitimate overlay window, we recommend keeping this configuration option disabled and implement the event blocking yourself to allow for exceptions.

If you use the blockTapjacking feature, and your app targets Android 12 (API level 31) or later, your app will need permission to hide overlay windows.