# One Bug To Rule Them All: Modern Android Password Managers and FLAG_SECURE Misuse

Android password managers set FLAG_SECURE on activities but not fragments/toasts, letting screen-capture apps record Secret Keys, cleartext passwords, and generated passwords.

- Payout: Research
- Severity: medium
- Program: 1Password
- Credited: Doyensec
- Disclosed: 2019-08-21
- Write-up quality: 6/10
- Original: https://blog.doyensec.com/2019/08/22/modern-password-managers-flag-secure.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2019-08-22-modern-password-managers-flag-secure-html
- Tags: domain:mobile impact:ato impact:data-leak kind:research platform:research sev:medium tech:android technique:recon technique:source-review vuln:info-disclosure

**Target:** Android password manager apps (activities, fragments, toasts, popups)
**Root cause:** FLAG_SECURE is per-window and not inherited by fragments or secondary windows (Toast, Dialog, PopupWindow, Spinner), so sensitive UI rendered outside the flagged activity is capturable by MediaProjection-based screen recorders.
**Steps:**
1. Install a screen-capture app with MediaProjection permission (e.g. mnml) on the victim device.
2. Open the target password manager and navigate to sensitive UI: 1Password Account Settings > Large Type (Secret Key), Keeper password field with Eye icon (cleartext toast), Dashlane password generator/autocomplete.
3. Start screen recording and observe that the fragment/toast content is captured despite the activity having FLAG_SECURE set.
**How found:** Read Mark Murphy's 2016 post on FLAG_SECURE window leaks, hypothesized the class might persist in modern apps, surveyed password managers with a screen-capture app (mnml) and found all four tested apps leaked via fragments/toasts.
**Exploitation:** A malicious app holding screen-record permission runs a MediaProjection capture in the background while the user interacts with the password manager; fragments and toasts lacking FLAG_SECURE are recorded, exposing Secret Keys, cleartext passwords, and generated passwords.
**Escalation:** Chaining leaked Secret Key with a captured Master Password yields the full account encryption key; leaked generated passwords plus autocomplete service list identify and compromise target accounts.
**Insight:** FLAG_SECURE only applies to the specific window it is set on; audit every secondary window a sensitive screen spawns (Toast, Dialog, PopupWindow, Spinner, autocomplete fragments) with a MediaProjection recorder rather than trusting the activity-level flag.