Preliminary research

AutoFail: Breaking Web Boundaries using Android's Autofill Framework

AutoFail: Breaking Web Boundaries using Android’s Autofill Framework

Riccardo Lamarca, Philipp Beer and Marco Squarcina · USENIX Association

AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

ADAPT traces Android autofill across five browsers and nine password managers, finding lost frame context and inconsistent matching that can leak credentials across sites. A separate UI-size oracle exposes saved-account presence to native apps. The paper defines attack prerequisites, demonstrates cases, and proposes stricter origin, scope and interaction rules.

Record

Document

AutoFail: Breaking Web Boundaries using Android’s Autofill Framework

Researcher

Riccardo Lamarca, Philipp Beer and Marco Squarcina

Published by

USENIX Association

Format

Whitepaper

Topic

Server

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• AutoFail: Breaking Web Boundaries using Android's Autofill Framework Repository
• AutoFail research artifacts

Tags

• android
• autofill
• password-manager
• same-origin-policy
• side-channel
• sop-bypass
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Riccardo Lamarca, Philipp Beer and Marco Squarcina, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 September 2026.