[PM-41420] Privileged app warning pop-up does not give ability to trust custom-signed browsers
- Dominant language
- Kotlin
- Stars
- 9.4k
- Forks
- 1.1k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 67
Description
### Steps To Reproduce
1. Install custom-signed build of a browser that is on the trusted list.
2. Attempt passkey operation.
3. Get pop-up displaying "Passkey operation failed because browser signature does not match"
### Expected Result
Pop-up should give option to manually trust the custom-signed browser application anyway.
### Actual Result
There is no way to get this browser added to trusted list as I can only press "Okay" in the pop-up, and I can't find any options in the "Privileged apps" menu to add my own override.
### Screenshots or Videos
_No response_
### Additional Context
If this is considered too risky since users may not read/understand before pressing, there are several options:
1. Implement pop-up as mentioned above, but also add a cool-down (e.g. 10 seconds) before the trust button becomes available.
2. A menu to add/override the list manually could be added to the "Privileged Apps" menu in settings.
### Build Version
2026.7.0 (21756)
### What server are you connecting to?
N/A
### Self-host Server Version
_No response_
### Environment Details
_No response_
### Issue Tracking Info
- [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
Contributor guide
Research direction
Start by reproducing the passkey flow with a custom-signed browser and inspect the Privileged Apps warning and browser-signature validation entry points. The work is done when a user can safely review and trust the custom-signed browser, the choice is reflected in subsequent passkey operations, and the behavior is covered by appropriate checks.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, kotlin
- Domain
- authentication, mobile, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100