Public cloneable() Method Without Final ('Object Hijack')

When a clone() method isn't marked final, subclasses can override it and bypass the original class's intended construction logic. This object hijacking technique lets an attacker create instances that skip critical initialization steps like security checks, resource allocation, or state validation, leading to unexpected behavior or security flaws. To prevent this, always declare the clone() method as final in security-sensitive classes, or consider alternative object creation patterns like copy constructors or factory methods. This ensures that object duplication follows a controlled path and maintains the object's integrity, preventing attackers from manipulating the cloning process to create malicious or unstable instances.