Skip to content

fix(android): Add filterTouchesWhenObscured to prevent Tapjacking#5155

Merged
romtsn merged 3 commits intogetsentry:mainfrom
abhishek-900:abhishek-900-patch-1
Mar 5, 2026
Merged

fix(android): Add filterTouchesWhenObscured to prevent Tapjacking#5155
romtsn merged 3 commits intogetsentry:mainfrom
abhishek-900:abhishek-900-patch-1

Conversation

@abhishek-900
Copy link
Contributor

Adds filterTouchesWhenObscured="true" to the user feedback dialog to prevent overlay/tapjacking attack ( CWE-1021)

📜 Description

Adds android:filterTouchesWhenObscured="true" attribute to the root RelativeLayout in sentry_dialog_user_feedback.xml to mitigate tapjacking/overlay attacks.

💡 Motivation and Context

Without filterTouchesWhenObscured, a malicious app can draw an invisible overlay on top of the user feedback dialog. This allows attackers to intercept user input or trick users into unintended actions (tapjacking).

This is flagged by static security scanners as a medium severity vulnerability (CWE-1021: Improper Restriction of Rendered UI Layers).

Reference: https://developer.android.com/reference/android/view/View#security

💚 How did you test it?

  • Verified XML syntax is valid
  • Manual visual inspection of the attribute placement

📝 Checklist

  • I added GH Issue ID & Linear ID
  • I added tests to verify the changes.
  • No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
  • I updated the docs if needed.
  • I updated the wizard if needed.
  • Review from the native team if needed.
  • No breaking change or entry added to the changelog.
  • No breaking change for hybrid SDKs or communicated to hybrid SDKs.

🔮 Next steps

N/A - This is a one-line security hardening fix with no follow-up required.

Adds  filterTouchesWhenObscured="true" to the user feedback dialog to prevent overlay/tapjacking attack ( CWE-1021)
Copy link
Member

@romtsn romtsn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@abhishek-900 thanks for reporting and opening the PR straight away - highly appreciated! Approving

@romtsn romtsn merged commit 20ec62a into getsentry:main Mar 5, 2026
62 of 64 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants