bitwarden / bitwarden/android

[PM-41420] Privileged app warning pop-up does not give ability to trust custom-signed browsers

Open
#7,236 4 comments 0 reactions 0 assignees View on GitHub
app:password-manager bug
Dominant language
Kotlin
Stars
9.4k
Forks
1.1k
Avg merge
1d 14h
Merged PRs (30d)
67

Description

### Steps To Reproduce

1. Install custom-signed build of a browser that is on the trusted list.
2. Attempt passkey operation.
3. Get pop-up displaying "Passkey operation failed because browser signature does not match"

### Expected Result

Pop-up should give option to manually trust the custom-signed browser application anyway.

### Actual Result

There is no way to get this browser added to trusted list as I can only press "Okay" in the pop-up, and I can't find any options in the "Privileged apps" menu to add my own override.

### Screenshots or Videos

_No response_

### Additional Context

If this is considered too risky since users may not read/understand before pressing, there are several options:
1. Implement pop-up as mentioned above, but also add a cool-down (e.g. 10 seconds) before the trust button becomes available.
2. A menu to add/override the list manually could be added to the "Privileged Apps" menu in settings.

### Build Version

2026.7.0 (21756)

### What server are you connecting to?

N/A

### Self-host Server Version

_No response_

### Environment Details

_No response_

### Issue Tracking Info

- [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the passkey flow with a custom-signed browser and inspect the Privileged Apps warning and browser-signature validation entry points. The work is done when a user can safely review and trust the custom-signed browser, the choice is reflected in subsequent passkey operations, and the behavior is covered by appropriate checks.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
authentication, mobile, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.