CAPEC-501
Android Activity Hijack
An adversary intercepts an implicit intent sent to launch a Android-based trusted activity and instead launches a counterfeit activity in its place. The malicious activity is then used to mimic the trusted activity's user interface and prompt the target to enter sensitive data as if they were interacting with the trusted activity.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-501: Android Activity Hijack: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/501.html and https://cve.bz/cve/capec/501?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
How the attack unfolds
Explore
The attacker looks for a way in.
[Find an android application that uses implicit intents] Since this attack only works on android applications that use implicit intents, rather than explicit intents, an adversary must first identify an app that uses implicit intents to launch an Android-based trusted activity, and what that activity is.
Experiment
They probe what they found.
[Create a malicious app] The adversary must create a malicious android app meant to intercept implicit intents to launch an Adroid-based trusted activity. This malicious app will mimic the trusted activiy's user interface to get the user to enter sensitive data.
1 technique
- Specify the type of intent wished to be intercepted in the malicious app's manifest file using an intent filter
[Get user to download malicious app] The adversary must get a user using the targeted app to download the malicious app by any means necessary
Exploit
They carry out the attack.
[Gather sensitive data through malicious app] Once the target application sends an implicit intent to launch a trusted activity, the malicious app will be launched instead that looks identical to the interface of that activity. When the user enters sensitive information it will be captured by the malicious app.
1 technique
- Gather login information from a user using a malicious app
Prerequisites
The adversary must have previously installed the malicious application onto the Android device that will run in place of the trusted activity.
Skills required
- High skill
The adversary must typically overcome network and host defenses in order to place malware on the system.
Resources required
Malware capable of acting on the adversary's objectives.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Read Data | Confidentiality |
Mitigations
To mitigate this type of an attack, explicit intents should be used whenever sensitive data is being sent. An 'explicit intent' is delivered to a specific application as declared within the intent, whereas an 'implicit intent' is directed to an application as defined by the Android operating system. If an implicit intent must be used, then it should be assumed that the intent will be received by an unknown application and any response should be treated accordingly (i.e., with appropriate security controls).
Never use implicit intents for inter-application communication.
Weaknesses it exploits
- CWE-923 Improper Restriction of Communication Channel to Intended Endpoints
Recent CVEs with these weaknesses
- 7.2CVE-2026-125361
Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without credentials or peer verification…
- 7.7CVE-2026-10756
TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with loca…
- 5.0CVE-2026-110909
Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code sub…
- 6.9CVE-2026-102085
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact t…
- 8.2CVE-2026-85925
Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.
- 7.0CVE-2026-70212
Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally.
- 9.0CVE-2026-86345
A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS…
- 9.1CVE-2026-92173
Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. Tha…
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
MITRE's words, unchanged: CAPEC-501 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.