Preliminary research

AutoFail: Breaking Web Boundaries using Android's Autofill Framework

Riccardo Lamarca, Philipp Beer and Marco Squarcina · USENIX Association

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

ADAPT traces Android autofill across five browsers and nine password managers, finding lost frame context and inconsistent matching that can leak credentials across sites. A separate UI-size oracle exposes saved-account presence to native apps. The paper defines attack prerequisites, demonstrates cases, and proposes stricter origin, scope and interaction rules.

Record

Researcher

Riccardo Lamarca, Philipp Beer and Marco Squarcina

Published by

USENIX Association

Format

Whitepaper

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Published artifacts

Tags

• android
• autofill
• password-manager
• same-origin-policy
• side-channel
• sop-bypass
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Riccardo Lamarca, Philipp Beer and Marco Squarcina, first published at the original source. Preserved copies are kept so the citation survives its host.