ViewStructure

web security mobile

Definition

ViewStructure

A ViewStructure is an OS-level description of an app’s on-screen input fields — their labels, types, and associated origin — that the Android Autofill Framework hands to a password manager in lieu of DOM access. For native Android UI elements the system provides the translation; for HTML form fields the browser must implement its own translation from DOM to ViewStructure.

The Translation Seam

Warning

There is no agreed-upon definition of the ViewStructure between password managers and browsers. Each browser reconstructs the field-to-origin mapping independently and may describe the same page differently. This is especially problematic for fields inside cross-origin iframes, where the field’s true origin and the surrounding page’s origin differ — the translation has to carry that distinction, and not every browser does.

Cross-Origin Credential Leak

a.com credentials offered for a b.com form field

A page on a.com embeds a login form in an iframe from b.com.

• the mismatch
  • some browsers describe the iframe form to the password manager as “a form in a.com” rather than “a form in b.com”, because the browser’s DOM-to-ViewStructure translation does not consistently track the iframe’s origin
• the consequence
  • the password manager, trusting the ViewStructure, offers the stored a.com credentials for a field that actually belongs to b.com
• the leak
  • if the user accepts the suggestion, credentials for a.com are sent to b.com — an origin the page never declared, and one the passwords were never meant for
• status
  • password managers and browsers were, at the time of the slides, working to agree on a shared ViewStructure definition to close the gap

The leak is a same-origin boundary that holds at the DOM but is reconstructed, not inherited, at the autofill layer — see the corresponding insight.