Task switcher snapshots retain the previous screen's sensitive content
Aliases: app switcher · recents screen leakage · recent tasks thumbnail
What it is
When an app leaves the foreground, the system captures its current screen as a thumbnail for the task switcher; the snapshot persists after the app exits, and anyone holding the unlocked device can open the switcher and see it. Account balances, medical records, private messages keep being exposed under the illusion that "the app is already closed" — task switcher leakage is the easiest piece of the screen-exposure surface to miss, because it lives on no app's interface.
Why it happens
The snapshot serves the switching experience (returning instantly to where you were), and the mechanism is a bitmap capture at a lifecycle point such as onPause, held in cache. Leakage is the product of snapshot content and retention time: users of finance apps often background the app on its most sensitive page (balance, card number), freezing the snapshot exactly there; the cache lives until the task is cleared, possibly days. The standard defense is background shielding: on losing focus the app replaces itself with a brand cover or blur layer, so the snapshot photographs the decoy, not the content. Everything turns on timing — shielding must happen before the capture; one frame late is one frame leaked, so the hook belongs at the head of the lifecycle, not after the exit animation.
Where it stops holding
The shield's side effect is that the first frame on return is also the decoy, adding one refresh step — real friction for frequent switchers, so shielding should be tiered by screen (sensitive pages shielded, ordinary ones not). The screenshot-exclusion flag and background shielding are two different mechanisms: exclusion forbids system capture (leaving the switcher nothing to show, but also blocking users from screenshotting their own receipts); the shield only swaps content. Combining them requires stating each one's scope. In resale and lending scenarios the switcher history is a long-lived residue, and the system-wide "clear all recents" depends on the user remembering to run it.
Applying it
- Default background shielding on for sensitive apps: swap to the decoy layer on focus loss, restore on focus; use a brand image or a blurred screenshot for the decoy — never solid black, which both signals "something is hidden" and reads as broken.
- Hook the shield at the lifecycle entry, not the animation callback; test with a capture at the instant of backgrounding and assert the snapshot shows the decoy.
- Layer the screenshot-exclusion flag for banking and health apps, and tell users why in-app screenshots are unavailable.
- Verification: an automated case that backgrounds the app on each sensitive page, reads the switcher's cached bitmap, and asserts it matches the decoy layer, not the page; regression covers every sensitive screen.