[Security] AutoSpill (AutoFill Vunerability in WebView)

**Describe the bug**

Black Hat Europe 2023 presentation ([PDF version](https://i.blackhat.com/EU-23/Presentations/EU-23-Gangwal-AutoSpill-Zero-Effort-Credential-Stealing.pdf)) introduced a AutoFill service vulnerability named _AutoSpill_ to circumtivate autofill mechanism.

It is ultimately caused by WebView's behavior and seems quite worrying with the combination of JavaScript injection (see results below).


**To Reproduce**

Steps to reproduce the behavior: See PDF p43-50.

**Expected behavior**

When in WebView, AutoFill should only get triggered in desired URL, and invulnerable to JavaScript injection.

**Android:**

| Model | Type | Android version | Android security patch |
| -------------------------- | ---------- | --------------- | ---------------------- |
| Poco F1 | Smartphone | Android 10 | December 2020 |
| Samsung Galaxy Tab S6 Lite | Tablet | Android 11 | January 2022 |
| Samsung Galaxy A52 | Smartphone | Android 12 | April 2022 |

**Additional context**

Personally I don't use AutoFill in WebView so am not affected but I'd like to know how much KeePassDX is affected and suggest a fix. Maybe you can temporarily disable AutoFill in WebView (like 1Password does) while the more sophisticated fix is on the way. You can find more details regarding the vulnerability in the PDF (notably p28-57) and reaction of other password manager on [TechCrunch](https://techcrunch.com/2023/12/06/your-mobile-password-manager-might-be-exposing-your-credentials/).
- Browser for Autofill: Android System WebView (no idea about version, but I think it's tested on latest version as of Dec 2022)

Edit: add missing result images.

Start with the AutoSpill presentation PDF, especially pages 28–57 and the reproduction steps on pages 43–50, then investigate KeePassDX’s WebView and autofill behavior. Done means establishing KeePassDX’s exposure and verifying a mitigation against the reported JavaScript and non-JavaScript cases.

Written by the indexing model from the issue text.