Credential theft via default task affinity

Task hijacking in Yeelink Yeelight App 3.5.4 and earlier allows local users to capture sensitive input through a malicious Android app. AndroidManifest.xml leaves taskAffinity at the com.yeelight.cherry package default, letting an attacker activity join the app's task and appear when the legitimate app starts. Exploitation requires a malicious app on the same Android device and user interaction with its substituted interface, enabling credential theft or deceptive permission grants.