bitwarden / bitwarden/android

[PM-29960] HyperOS 3 CredentialSelectorActivity crashes with ClassCastException (Long to Integer)

Open
#6,284 5 comments 2 reactions 0 assignees View on GitHub
app:password-manager bug-passkey
Dominant language
Kotlin
Stars
9.4k
Forks
1.1k
Avg merge
1d 14h
Merged PRs (30d)
67

Description

### Origin

Native Application (non-browser app)

### Web URL or App name

webauthn.io

### Passkey Action

- [ ] Creating new passkey (Registration)
- [x] Signing in (Authentication)

### Build Information

2025.12.0

### Additional Information

**1. Description:**
On Xiaomi 15 (HyperOS 3 CN, Android 16), Bitwarden is unable to complete the Passkey authentication or registration flow when system biometrics (Fingerprint/Face) are enabled. The system's `com.android.credentialmanager` component crashes immediately upon trying to show the selector UI.

**2. Steps to Reproduce:**

1. Use Xiaomi 15 with Fingerprint/Face unlock enabled.
2. Set Bitwarden as the primary Credential Provider.
3. Attempt to log in to a website/app using a Passkey stored in Bitwarden.
4. The system "CredentialSelectorActivity" fails to pop up, and Bitwarden receives a `TYPE_NO_CREDENTIAL` or cancellation error.

**3. Expected Behavior:**
The system credential selector should appear, allowing the user to select the Bitwarden credential and authenticate via biometrics.

**4. Actual Behavior:**
The system component `com.android.credentialmanager` crashes due to a `ClassCastException`.

**5. Root Cause Analysis (from Logcat):**
The crash occurs in the system's biometric pre-validation logic. Android 15 has updated certain `SliceItem` fields to `Long`, but Xiaomi's `CredentialSelectorActivity` implementation still calls `getInt()`, causing a type mismatch.

**6. Supporting Logcat Trace:**

```text
E CredentialSelectorActivity: java.lang.ClassCastException: java.lang.Long cannot be cast to java.lang.Integer
E CredentialSelectorActivity: at android.app.slice.SliceItem.getInt(SliceItem.java:238)
E CredentialSelectorActivity: at com.android.credentialmanager.ktx.CredentialKtxKt.predetermineAndValidateBiometricFlow(CredentialKtx.kt:98)
E CredentialSelectorActivity: at com.android.credentialmanager.ktx.CredentialKtxKt.getCredentialOptionInfoList(CredentialKtx.kt:307)
E CredentialSelectorActivity: at com.android.credentialmanager.ktx.CredentialKtxKt.toProviderList(CredentialKtx.kt:122)
E CredentialSelectorActivity: at com.android.credentialmanager.CredentialSelectorActivity.onCreate(CredentialSelectorActivity.kt:91)

```

**7. Critical Finding:**
**Disabling all system biometrics (removing fingerprints/face data) resolves the crash**, and the Bitwarden selector UI appears correctly.

### Issue Tracking Info

- [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the passkey flow on a Xiaomi 15 running HyperOS 3 with system biometrics enabled, then review the supplied CredentialSelectorActivity stack trace and compare behavior with biometrics disabled. Done would require identifying a Bitwarden-side path to avoid or resolve the external CredentialSelectorActivity crash; the issue does not name a Bitwarden file or test.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
authentication, mobile, operating-systems
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.