<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.attacker.twapoc">

    <uses-permission android:name="android.permission.INTERNET" />

    <!-- Needed on Android 11+ to bind Chrome's CustomTabsService. -->
    <queries>
        <package android:name="com.android.chrome" />
        <package android:name="com.chrome.beta" />
        <package android:name="com.chrome.dev" />
        <package android:name="com.chrome.canary" />
        <package android:name="org.chromium.chrome" />
        <intent>
            <action android:name="android.support.customtabs.action.CustomTabsService" />
        </intent>
    </queries>

    <application
        android:label="TWA PoC"
        android:allowBackup="false">

        <activity
            android:name=".MainActivity"
            android:exported="true">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>

        <!-- DAL statement linking this APK to the attacker origin so
             Chrome's TWA verifier (Verifier.verify(targetUrl)) succeeds. -->
        <meta-data
            android:name="asset_statements"
            android:resource="@string/asset_statements" />
    </application>
</manifest>
