Abstract
<title>Abstract</title> <p>Progressive Web Applications (PWAs) and Trusted Web Activities (TWAs) enable flexible app-like experiences using web technologies, while introducing security challenges. Malicious developers can duplicate PWA web links to create counterfeit native applications, diverting users and monetizing unauthorized replicas. Such practices pose significant threats to both users and legitimate application owners, highlighting the need for effective anti-replication mechanisms. We propose a query-parameter-based security framework that utilizes encryption and two unique identifiers to mitigate unauthorized replication while circumventing the one-way communication limitation inherent to TWAs, while reducing the development complexity associated with postMessage-based solutions. We analyze potential vulnerabilities of the proposed approach and introduce enhanced countermeasures to address identified weaknesses. The work also presents a prototype implementation that embeds Unix timestamps and device identifiers into query parameters to bind PWAs to legitimate installations. Effectiveness is evaluated through simulated attack scenarios, with validation performed using a realistic dataset reflecting mobile application user behavior.</p>