Android SDK triggers privacy warnings due to Permissions.GET_TASKS

[akirmse]

Using com.mapbox.maps:android:10.1.0, I get the following "Security and Trust" warning in Google's Play Console when trying to release my app:

Anomalous Permission Usage
Warning
brightness_1
Privacy
Your app is requesting permissions which are used by less than 1% of functionally similar apps:

android.permission.GET_TASKS

---

In addition, I had to disclose the collection of installed apps in the Play Console's data safety section. I received an email from Google telling me that my data safety report was incorrect:

We found an issue in the following area(s):

Policy Declaration for Play Safety Label: App Activity Data Type - Installed Apps
Starting in February 2022, Data safety sections reviewed and approved will start appearing to users; make any changes needed by then. Starting April 2022, your app must be in compliance with this policy or app updates will be rejected. If your app continues to be non-compliant beyond April 2022 your app may face additional enforcement actions in the future.

---

So every app that uses Mapbox will have to declare the collection (and possibly reporting?) of installed apps, or they won't be able to publish updates after April.

I found that this permission is coming from the following Mapbox library:
com.mapbox.mapboxsdk:mapbox-android-telemetry:8.1.0

I'm not sure why it would need to know what other apps are installed. This seems invasive at best, and much more serious if this is actually being sent off the phone, which apps have no way of knowing.

Can this permission be removed from the telemetry library?

[kiryldz]

additional findings from @pengdev

Looking at the implementation, the GET_TASKS is only used to get the telemetry of whether the current app is in the foreground or background. However GET_TASKS permission indeed also allows to read the state of other running apps as well, this might be a privacy concern.

[akirmse]

The Android documentation suggests that this is not a good idea:

https://developer.android.com/reference/android/app/ActivityManager#getRunningAppProcesses()

public List<ActivityManager.RunningAppProcessInfo> getRunningAppProcesses ()
Returns a list of application processes that are running on the device.

Note: this method is only intended for debugging or building a user-facing process management UI.

[mchiu-snap]

Thanks for fixing this! Will it be published soon in a new release? Unfortunately GET_TASKS permission was added in the same version as the pending intent immutability fix for Android 12 (see #535).