Definition
Mobile Password Manager
A mobile password manager (PWM) autofills credentials inside apps and embedded web content on a mobile OS, mediated by the OS autofill framework rather than by direct DOM access as on desktop. The PWM receives a ViewStructure describing the on-screen input fields and decides which stored credentials to offer.
Desktop vs Mobile
Two different trust boundaries
Desktop and mobile PWMs sit on opposite sides of the DOM. On desktop the PWM is a browser extension with direct DOM access; on mobile the OS inserts itself between the PWM and the page.
- Desktop — the PWM runs as a browser extension that can read the DOM directly and inject into input fields; no intermediary.
- Android — the Android Autofill Framework acts as an intermediary layer: the PWM cannot read the DOM, and instead receives a ViewStructure from the system. For native UI elements the system provides the translation; for HTML, the browser has to implement its own DOM-to-ViewStructure translation.
The Intermediary Solves and Creates a Problem
Obs
The intermediary layer solves the desktop problem — a mobile PWM cannot drive a DOM-direct attack, because it never sees the DOM. But the translation itself becomes a new trust boundary: the link between an input field and the origin it belongs to is now something the browser reconstructs and hands to the PWM, rather than something the PWM derives itself. When that reconstruction is wrong, as with ViewStructure mismatches across
iframeboundaries, the PWM offers the wrong origin’s credentials.