Researchers detail AutoSpill, a flaw on Android that can expose users' saved credentials from 1Password, LastPass, and other popular password managers
A number of popular mobile password managers are inadvertently spilling user credentials due to a vulnerability in the autofill functionality of Android apps.
Context & Ripple Effects
AutoSpill places Android autofill in a longer record of mobile-app security boundaries failing around sensitive authentication data. Earlier research showed Android apps could capture one-time codes from Google Authenticator through screenshots, illustrating that a password or code manager’s protections can be undermined by the surrounding platform and app behavior.
The issue is especially consequential for 1Password, LastPass, and similar tools because autofill is the handoff point between a credential vault and third-party apps. LastPass had also drawn scrutiny over embedded trackers in its Android app, reinforcing that password-manager risk extends beyond encrypted storage alone.
First-order effects
- Users of affected Android password managers may have saved login credentials exposed when autofill is invoked in vulnerable app contexts.
- Password-manager providers and Android app developers must assess their autofill implementations and the app-side conditions that permit credential spillover.
Second-order effects
- Security teams may treat Android autofill as a distinct attack surface, rather than assuming a password manager’s vault encryption covers every credential handoff.
- Competing password managers face pressure to demonstrate safer mobile autofill behavior, while users may become more cautious about granting autofill access to unfamiliar apps.
Third-order effects
- If similar flaws recur, credential management will increasingly be judged on the security of the full permission and delivery path—not just on vault encryption or master-password design.
- The pattern points toward stronger platform-level isolation for sensitive authentication data, though the eventual division of responsibility between Android, app developers, and vault providers remains uncertain.
The trend: Mobile identity security is shifting from protecting stored secrets to securing every platform-mediated handoff of those secrets into apps and services.