The information that I've found this far does not provide exact details of vulnerability but as far as I know there is not a technical vulnerability but a poorly designed API which allows for clever social engineering attacks.
Is there a real use case for the API behavior that StrandHogg uses?
If I have understood correctly, the API the vulnerability uses allow attacker to place its own Activity on back stack of victim "Back stack". From reading the API description and the provided example cases the main intent of this API is to allow including to embed activities from other apps to be displayed within your own task. However, the StrandHogg vulnerability seems to the other way around: using API to push your own activity over another task's "Back stack".