[BUG] Autofill trusted-browser allowlist does not verify app signatures

Checks

• I have read the FAQ section, searched the open issues, and still think this is a new bug.

Describe the bug you encountered:

Summary

In KeePass2Android v1.15-r3, Autofill identifies trusted browsers by package name only and does not verify the installed app’s signing certificate.

If an allowlisted browser is not installed, an attacker can install an APK signed with their own certificate but using that browser’s package name. KeePass2Android then treats the malicious app as a trusted browser for any reported web domain.

When the user selects an Autofill suggestion, credentials for that domain may be filled into fields controlled by the malicious app.

Root Cause

IsTrustedApp() accepts a package when its name appears in the hard-coded or user-created allowlist:

Kp2aDigitalAssetLinksDataSource.cs

IsTrustedLink() subsequently trusts that package for every web domain:

Kp2aDigitalAssetLinksDataSource.cs

The parser marks the package/domain combination as compatible, after which KeePass2Android can build a Dataset containing real credential values:

AutofillParser.cs

AutofillServiceBase.cs

The source has tracked package-signature verification as a TODO since the original Autofill implementation.

Impact

Successful exploitation can disclose passwords, OTPs, payment fields, or other Autofill secrets to an unauthorized app.

Reference

Android AutofillService security guidance

Android SigningInfo

Describe what you expected to happen:

Expected Behavior

Trusted-browser status should be bound to both:

package name; and

an approved signing-certificate identity.

An unrelated signer must not inherit browser trust merely by using the same package name.

Recommended Fix

Bind every browser allowlist entry to its package name and accepted certificate digests.

Verify the installed package through Android SigningInfo for every request.

Correctly support signing-certificate rotation and multiple signers.

Bind user-created trusted-app records to the signer present when trust is granted.

Invalidate trust after uninstall/reinstall or signer changes.

If verification fails, show a warning or withhold real credential datasets.

What version of Keepass2Android are you using?

v1.15-r3

Which version of Android are you on?

Android 8.0+ (API 26+)

Start with IsTrustedApp() and IsTrustedLink() in src/keepass2android-app/services/AutofillBase/Kp2aDigitalAssetLinksDataSource.cs, then trace the dataset flow through AutofillParser.cs and AutofillServiceBase.cs. Read the Android SigningInfo guidance and determine how allowlist records should bind package names to signer identities, including rotation, multiple signers, and reinstall changes. Done means an unrelated signer cannot receive real credential datasets while approved signers remain supported.