Sensitive-input theft via nonempty task affinity

Task hijacking in SAP Fiori Client before 3.2 allows attackers with a malicious Android app to capture sensitive user input. A nonempty taskAffinity declaration in AndroidManifest.xml lets the malicious activity enter or replace the client's task, presenting attacker-controlled UI as part of the legitimate app. Exploitation requires installation and user interaction with a malicious app on the same Android device; exposed input can include confidential business or authentication data.