Back
New

Android Autofill Framework: Web Security Boundaries

How translated context, scope, validation, and timing shape credential safety

9 chapters93 min total
New
Tech
Keywords
Android Autofill FrameworkAutoFailSame-Origin PolicyPassword managerCredential leakageAccount oracleDigital Asset LinksIframeOriginSandbox
Overview

This series traces how Android Autofill Framework translates origin, frame, and isolation context from a browser DOM into a mediated virtual structure, how omissions and heuristics can enable cross-site writes, wrong-site suggestions, concealed context, insecure fills, or account-existence side channels, and how evidence moves from controlled tests to web measurements and selected live cases. It proposes explicit ancestry and origin data, narrow scope, final validation, warnings, and delayed lookup, while limiting claims to tested conditions.

Learning outcomes
  • Android Autofill Framework is a separate security path: browser isolation does not automatically constrain the translated structure or final credential write.
  • AutoFail found six security issues from interacting browser and password-manager flaws across tested combinations; this does not establish universal exposure.
  • Web measurements and live cases show attack preconditions and selected viability, not an exploit rate or current exposure for every product.
  • Safer design combines complete ancestry and explicit origin state with narrow field scope, conservative matching, final validation, warnings, and delayed lookup.
Keywords
Android Autofill FrameworkAutoFailSame-Origin PolicyPassword managerCredential leakageAccount oracleDigital Asset LinksIframeOriginSandbox

Chapters

1
Android Autofill Framework: Context Preservation
Why browser-to-service translation decides where credentials may go
9 min · Why browser-to-service translation decides where credentials may go
9 min
2
Android Autofill Framework: Credential Lifecycle
Who builds, matches, releases, and writes a fill response
11 min · Who builds, matches, releases, and writes a fill response
11 min
3
Android Autofill Framework: Origin and Frame Context
What virtual structures lose about sites, ports, and isolation
12 min · What virtual structures lose about sites, ports, and isolation
12 min
Android Autofill Framework: Cross-Site Leakage and Suggestions
How mixed web contexts turn matching into a wrong-site write or offer
10 min · How mixed web contexts turn matching into a wrong-site write or offer
10 min
Android Autofill Framework: Failure Checkpoints
A diagnostic model for omission, misreading, validation, and awareness
11 min · A diagnostic model for omission, misreading, validation, and awareness
11 min
Android Autofill Framework: Cross-Context Account Oracle
How window geometry can reveal a lookup before user authorization
9 min · How window geometry can reveal a lookup before user authorization
9 min
Android Autofill Framework: Evidence Beyond the Lab
How tests, web samples, and live sites support different claims
11 min · How tests, web samples, and live sites support different claims
11 min
Android Autofill Framework: Repairing the Contract
Explicit ancestry, narrow scope, conservative matching, and delayed lookup
10 min · Explicit ancestry, narrow scope, conservative matching, and delayed lookup
10 min
Android Autofill Framework: The Context Contract
What browsers, Android, password managers, and users must preserve
10 min · What browsers, Android, password managers, and users must preserve
10 min

Preview every chapter · Unlock full text, audio, and video from chapter 4

Plans
Ch.1-3 FreeCh.4-9 Premium

FAQ

Why can Android Autofill Framework cross web security boundaries?

It can do so when browser-to-Android translation loses origin, frame ancestry, or isolation context, and later components use the incomplete structure to choose or write a credential.

Does this mean Android Autofill Framework bypasses the Same-Origin Policy?

No. The findings concern a separate autofill data path: scripts may remain blocked by the Same-Origin Policy while credentials are misrouted through Android mediation.

Can an Android app learn account existence without receiving a password?

Yes. In the tested oracle path, a potentially unwanted app inferred a matching account from account-dependent autofill-window dimensions before any password was released; the study found this in three of 13 managers.

How strong is the evidence that Android autofill attacks work outside a lab?

The evidence shows tested client failures, measurable web preconditions, and selected live-site demonstrations, but not a universal exploit rate or current exposure for every product.

What would make Android Autofill Framework safer?

A safer design preserves complete ancestry and explicit origin and isolation state, limits fields to the focused context, validates targets, warns on unusual contexts, and delays account-dependent lookup until confirmation; Digital Asset Links alone is not enough.