[MOO-2326] fix: address security issues on Android by hardening against overlay

CHANGELOG.md

@@ -6,10 +6,22 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 ## [Unreleased]
 
+- We hardened the Android main screen against overlay and tapjacking attacks, and removed the unused `SYSTEM_ALERT_WINDOW` permission.
+
+## [19.1.3] - 2026-08-07
+
 - We fixed an issue that could cause iOS apps to restart repeatedly after an OTA update.
 - Replaced @notifee/react-native with react-native-notify-kit library.
 - We addressed an issue on iOS, where a iOS-system dialogue would pop up during app startup, requesting a password. This was identified as part of Keychain read queries when a one-time keychain migration occurred.
 
+## [19.1.2] - 2026-07-03
+
+- Clean up of react-native patch, removing native-side patching to allow using prebuilt binaries on iOS.
+
+## [19.1.1] - 2026-06-23
+
+- We fixed an issue that could cause iOS apps to restart repeatedly after an OTA update.
+
 ## [19.1.0] - 2026-06-03
 
 - We updated the react-native to v0.84.1

android/app/src/appstore/java/com/mendix/nativetemplate/MainActivity.java

@@ -21,6 +21,10 @@ protected void onCreate(@Nullable Bundle savedInstanceState) {
         boolean hasDeveloperSupport = ((MainApplication) getApplication()).getUseDeveloperSupport();
         mendixApp = new MendixApp(AppUrl.getUrlFromResource(this), MxConfiguration.WarningsFilter.none, hasDeveloperSupport, false);
         super.onCreate(savedInstanceState);
+        getWindow().getDecorView().setFilterTouchesWhenObscured(true);
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
+            getWindow().setHideOverlayWindows(true);
+        }
 
         // Checks the current theme and apply the correct style (Backwards compatible)
         boolean isDarkMode;

android/app/src/debug/AndroidManifest.xml

@@ -4,7 +4,6 @@
     package="com.mendix.nativetemplate">
 
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS"/>
-    <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW"/>
 
     <application android:usesCleartextTraffic="true" tools:targetApi="28" tools:ignore="GoogleAppIndexingWarning"/>
 </manifest>

android/app/src/dev/AndroidManifest.xml

@@ -17,6 +17,7 @@
             android:configChanges="keyboard|keyboardHidden|orientation|screenSize|uiMode|fontScale"
             android:launchMode="singleInstance"
             android:windowSoftInputMode="adjustPan"
-            android:exported="true"></activity>
+            android:taskAffinity=""
+            android:exported="false"></activity>
     </application>
 </manifest>

android/app/src/dev/java/com/mendix/nativetemplate/MainActivity.java

@@ -57,6 +57,10 @@ public class MainActivity extends AppCompatActivity implements ZXingScannerView.
     protected void onCreate(@Nullable Bundle savedInstanceState) {
         super.onCreate(savedInstanceState);
         setContentView(R.layout.activity_main_dev);
+        getWindow().getDecorView().setFilterTouchesWhenObscured(true);
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
+            getWindow().setHideOverlayWindows(true);
+        }
 
         appPreferences = new AppPreferences(this);
 

android/app/src/main/AndroidManifest.xml

@@ -7,7 +7,8 @@
                      tools:ignore="QueryAllPackagesPermission"/>
 
     <uses-permission android:name="android.permission.INTERNET" />
-    <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" />
+    <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" tools:node="remove" />
+    <uses-permission android:name="android.permission.HIDE_OVERLAY_WINDOWS" />
     <uses-permission android:name="android.permission.READ_PHONE_STATE" />
     <uses-permission android:name="android.permission.CAMERA" />
     <uses-permission android:name="android.permission.RECORD_AUDIO" />
@@ -68,6 +69,7 @@
         android:screenOrientation="portrait"
         android:configChanges="keyboard|keyboardHidden|orientation|screenSize|uiMode|fontScale"
         android:windowSoftInputMode="adjustPan"
+        android:taskAffinity=""
         android:exported="true">
         <intent-filter>
             <action android:name="android.intent.action.MAIN" />