dotnet / dotnet/maui

Framework-created dialogs do not respect application screen security settings, allowing dialog content to be captured in screenshots

Open
#36,239 0 comments 1 reaction 0 assignees View on GitHub
area-controls-datepicker platform/android platform/ios t/bug
Dominant language
C#
Stars
23.3k
Forks
2k
Avg merge
1d 15h
Merged PRs (30d)
290

Description

### Description

Applications that implement screen protection to prevent screenshots expect that protection to apply consistently across the entire application.
However, framework-created dialogs (such as DatePicker, TimePicker, and other native dialogs presented by .NET MAUI) are still visible in screenshots, even when the application's main content is protected.
This behavior is reproducible on both Android and iOS.
Android
When WindowManagerFlags.Secure is applied to the application's main Activity, the activity is protected, but dialogs created by .NET MAUI (for example, the native DatePickerDialog) are still captured in screenshots.
This suggests that the secure window flag is not propagated to framework-created dialogs.
iOS
Applications that implement screenshot protection using platform-specific secure content techniques observe that native dialogs presented by .NET MAUI remain visible in screenshots.
Although iOS does not provide a direct equivalent to Android's FLAG_SECURE, developers expect framework-created dialogs to follow the same screen protection strategy as the hosting page.

### Steps to Reproduce

Create a new .NET MAUI application.
Enable screen protection for the application.
Android: Apply WindowManagerFlags.Secure to the main activity.
iOS: Apply the application's screen protection mechanism (for example, secure content implementation).
Add a DatePicker (or another control that presents a native dialog).
Open the dialog.
Take a screenshot.

Expected Behavior
Once screen protection is enabled for the application:
All framework-created dialogs should respect the application's screen security policy.
Screenshots should be blocked or protected consistently for both the application content and dialogs.
Developers should not need to implement platform-specific custom handlers for every dialog control.
Actual Behavior
The main application content is protected, but dialogs created by .NET MAUI remain visible in screenshots.
This results in inconsistent protection and can expose sensitive information displayed in dialogs.
Affected Controls
Examples include:
DatePicker
TimePicker
Other native dialogs presented by .NET MAUI
Why this matters
Many enterprise, financial, healthcare, and government applications rely on screen protection to prevent sensitive information from being captured.
Currently, developers can secure the main application window, but dialog content remains exposed, leading to inconsistent behavior across the application.

### Link to public reproduction project repository

_No response_

### Version with bug

9.0.100 SR10

### Is this a regression from previous behavior?

Not sure, did not test other versions

### Last version that worked well

9.0.100 SR10

### Affected platforms

iOS, Android

### Affected platform versions

Android all versions, iOS 26, 25

### Did you find any workaround?

No

### Relevant log output

```shell

```

Contributor guide

Open the contributing guide

Research direction

Start with a minimal .NET MAUI app using the reported Android WindowManagerFlags.Secure and iOS secure-content mechanisms, then compare the protected main content with native DatePicker and TimePicker dialogs. Done means framework-created dialogs on both platforms follow the application's screen-protection behavior and are not exposed in screenshots.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, csharp, ios
Domain
mobile, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.