IIIT-Hyd: Android password managers can be hacked, Google reacts

Researchers from IIIT at Hyderabad presented at Black Hat Europe security conference, revealing that most Android password managers are vulnerable to the AutoSpill hacking attack. This attack allows malicious apps to steal user data during autofill, even without JavaScript injection. The vulnerability stems from Android’s lack of clear guidelines for handling autofilled data, leaving room for interception. Several popular password managers, including 1Password, LastPass, and Keeper, were found to be vulnerable. However, Google Smart Lock and DashLane, which utilize a different autofill approach, did not leak data unless JavaScript injection was used.