Task affinity is the Android attribute that tells the system which task an activity prefers to belong to. It influences whether activities from the same or different apps share a task, and can affect navigation, recent apps grouping and task hijacking risk if misused.
What task affinity does in Android
Task affinity is a navigation and task-grouping attribute, so its security significance comes from how the system decides which activities belong together in the back stack and recent-apps view. In normal use, it helps shape expected app flow; in hostile or careless use, it can blur app boundaries and make later activity launch behaviour less predictable.
How task affinity affects activity grouping
Android uses affinity as one of the signals for task placement, rather than as a permission boundary. Activities from the same app usually share an intuitive task structure, but different apps can also end up in the same task when the affinity value and launch mode interactions line up. That makes it important to think about affinity as a user-experience and task-management control, not as a security control by itself.
Because task membership affects how activities are resumed, navigated and surfaced in recents, an unexpected affinity value can change what the user believes they are returning to. That is why the attribute deserves careful design review in apps that launch deep links, hand off between activities, or mix internal and external entry points.
Why task affinity can become a security concern
The main risk is task hijacking, where an activity appears in a task the user associates with another app or flow. If an application allows an untrusted or poorly scoped activity to join a task, the result can be confusing navigation, misleading UI context, or unintended exposure of a sensitive screen through task reuse.
Affinity problems usually become visible when task boundaries are assumed to equal trust boundaries. They do not. The platform is managing activity placement, not verifying whether the content in that task should be treated as equivalent from a security perspective.
Task affinity in app design and review
Developers should treat task affinity as a design choice that can affect state, navigation and user trust. The safest default is usually to preserve expected app-local task behaviour unless there is a clear product reason to group activities differently. Special care is needed when activities can be reached from notifications, exports, shortcuts or external intents, because those entry points can change how tasks are created or reused.
For reviewers, the practical question is whether the chosen affinity supports a coherent and expected task model. If it does not, the app may still function, but it can become easier to confuse users or create an opportunity for task-boundary abuse.
What to validate when task affinity is used
Validate how activities appear in the back stack and recent-apps list, especially after cross-app launches, deep links and warm starts. Check whether sensitive screens can be surfaced in a task a user might associate with a different app, and whether any task reuse creates misleading continuity between unrelated flows.
Where the design does require non-default task behaviour, review it alongside intent handling, exported components and activity launch modes. Task affinity is only one part of the launch model, so the real security outcome depends on the surrounding activity and intent configuration.
Risk and Threat Considerations
Task affinity can create user-interface trust gaps when activities from different origins are allowed to share a task or appear in a familiar recent-apps slot. That makes it relevant to task hijacking, deceptive context switching and accidental exposure of sensitive screens through reused task state.
Failure mechanism: An attacker or misconfigured app flow exploits task reuse, affinity mismatch or unexpected activity placement so that a screen appears inside a task the user trusts.
Impact: Users may be led into the wrong app context, sensitive information may be surfaced in an unintended flow, and the app’s navigation history can become easier to misuse or misinterpret.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-3 — Access Enforcement | Task placement can expose screens to unintended access contexts. |
| Recommendation — Enforce access rules so sensitive activities are only reachable through approved app flows. | ||
| OWASP ASVS | V8 — Authorization | Task sharing can affect which user flows reach protected screens. |
| V16 — Security Logging and Error Handling | Unexpected task reuse can complicate review of suspicious navigation patterns. | |
| Recommendation — Verify that protected screens remain reachable only through intended authorization paths. Log abnormal navigation and activity launch behaviour that may indicate task misuse. | ||
Practitioner Guidance
Why practitioners should care: Task affinity is easy to overlook because it looks like a UX attribute, but it can materially change how sensitive activities are grouped and resumed. That makes it worth reviewing whenever an app handles deep links, cross-activity flows or externally reachable screens.
What to watch for: Look for activities that should never share a task with unrelated entry points, and for any screen whose task placement could alter user trust or reveal state from a previous flow. If task behaviour is not explicitly being designed, it is often being inherited by accident.
Related resources from NHI Mgmt Group
- What is the difference between role-based access and task-scoped access for AI agents?
- When does certificate management become an NHI risk instead of an IT task?
- Why do autonomous AI agents create more access risk than task bots?
- What is the difference between task-scoped access and permanent NHI privileges?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org