The App That Can Ask Whether You Have an Account

The Android Autofill Framework creates a second kind of security boundary when a native app can trigger a request aimed at a web domain. The Cross-Context Account Oracle shows why: a potentially unwanted app can sometimes infer whether the password manager has credentials for a site without receiving the password. This chapter follows that lifecycle from the app's target request to the autofill window's geometry, then separates Digital Asset Links association from the timing of credential lookup so readers can see how metadata can leak before authorization is complete.

This is not the same as the cross-site attacks in which a malicious frame receives a filled value. The oracle's output is a fact about the user's account relationship with a service. That fact can be sensitive even when the password remains inside the password manager and the request is cancelled before a field is filled.

How window geometry becomes an account oracle

The attacker in this scenario is a potentially unwanted app, or PUA: an application that may appear to offer an ordinary function but is not trusted with the user's account information. The study does not assume that the app has been granted a special permission. Its relevant capability is that it can participate in the Android autofill interface and observe layout information about the UI that the system displays for the request.

The PUA begins by constructing a virtual autofill structure and placing a target website into its web-domain metadata. The target might be a service the app wants to test. The app then triggers an autofill request. Android sends that structure to the selected password manager in the ordinary mediated flow, and the manager prepares a response containing suggestions or a prompt.

Some password managers size their suggestion window according to how many credentials they found for the requested URL. A request for a site with a saved credential can therefore produce a window with different dimensions from a request for a site that has no saved credential. The dimensions are not intended to be an account database. They are a layout consequence of the manager's response, but the Android window-management interface makes enough of that layout observable to the requesting app in the vulnerable implementations.

The PUA does not need to read the password. It measures the window, compares it with a baseline request for a nonexistent site, and asks whether the dimensions differ. If they do, the app infers that the password manager found a credential for the target site. It can then cancel the request without asking the user to select anything and without causing a form field to be populated.