AutoSpill vulnerability of Android password managers exposes login data

At the Black Hat Europe 2023 security conference, researchers from the Indian Institute of Information Technology presented a new vulnerability called 'AutoSpill'. Due to a gap in the Android WebView module, which is based on the Chrome browser and used to enter passwords in apps, malicious apps can theoretically access data from the password manager unnoticed.

If a password manager automatically enters the access data using autofill, the login data can be inserted into data fields of the underlying app in WebView instead of the website. In this case, the app itself can simply read the login data, which should actually just be inserted into the login page within WebView.

This means that phishing is not necessary here, i.e. displaying a fake website with username and password fields, but rather the real login page of an internet service is displayed. The security vulnerability has been tested with password managers using Android's own Google Smart Lock as well as the third-party apps 1Password, Dashlane, Enpass, LastPass, Keepass2Android and Keeper.

According to the researchers, the 'AutoSpill' vulnerability occurs in Android versions 10, 11 and 12 and can be exploited even with JavaScript turned off in all password managers (with the exception of Google Smart Lock and Dashlane). If JavaScript is activated, all aforementioned password managers are affected by the security gap.