Framework-created dialogs do not respect application screen security settings, allowing dialog content to be captured in screenshots
- Dominant language
- C#
- Stars
- 23.3k
- Forks
- 2k
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 290
Description
### Description
Applications that implement screen protection to prevent screenshots expect that protection to apply consistently across the entire application.
However, framework-created dialogs (such as DatePicker, TimePicker, and other native dialogs presented by .NET MAUI) are still visible in screenshots, even when the application's main content is protected.
This behavior is reproducible on both Android and iOS.
Android
When WindowManagerFlags.Secure is applied to the application's main Activity, the activity is protected, but dialogs created by .NET MAUI (for example, the native DatePickerDialog) are still captured in screenshots.
This suggests that the secure window flag is not propagated to framework-created dialogs.
iOS
Applications that implement screenshot protection using platform-specific secure content techniques observe that native dialogs presented by .NET MAUI remain visible in screenshots.
Although iOS does not provide a direct equivalent to Android's FLAG_SECURE, developers expect framework-created dialogs to follow the same screen protection strategy as the hosting page.
### Steps to Reproduce
Create a new .NET MAUI application.
Enable screen protection for the application.
Android: Apply WindowManagerFlags.Secure to the main activity.
iOS: Apply the application's screen protection mechanism (for example, secure content implementation).
Add a DatePicker (or another control that presents a native dialog).
Open the dialog.
Take a screenshot.
Expected Behavior
Once screen protection is enabled for the application:
All framework-created dialogs should respect the application's screen security policy.
Screenshots should be blocked or protected consistently for both the application content and dialogs.
Developers should not need to implement platform-specific custom handlers for every dialog control.
Actual Behavior
The main application content is protected, but dialogs created by .NET MAUI remain visible in screenshots.
This results in inconsistent protection and can expose sensitive information displayed in dialogs.
Affected Controls
Examples include:
DatePicker
TimePicker
Other native dialogs presented by .NET MAUI
Why this matters
Many enterprise, financial, healthcare, and government applications rely on screen protection to prevent sensitive information from being captured.
Currently, developers can secure the main application window, but dialog content remains exposed, leading to inconsistent behavior across the application.
### Link to public reproduction project repository
_No response_
### Version with bug
9.0.100 SR10
### Is this a regression from previous behavior?
Not sure, did not test other versions
### Last version that worked well
9.0.100 SR10
### Affected platforms
iOS, Android
### Affected platform versions
Android all versions, iOS 26, 25
### Did you find any workaround?
No
### Relevant log output
```shell
```
Contributor guide
Research direction
Start with a minimal .NET MAUI app using the reported Android WindowManagerFlags.Secure and iOS secure-content mechanisms, then compare the protected main content with native DatePicker and TimePicker dialogs. Done means framework-created dialogs on both platforms follow the application's screen-protection behavior and are not exposed in screenshots.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, csharp, ios
- Domain
- mobile, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100