github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-05-06 07:48:22 -05:00
Code Issues 1.1k Packages Projects Releases 122 Wiki Activity

[GH-ISSUE #6250] [PM-29479] Bitwarden Android app interferes with Google passkey reverification #39372

New Issue
Open
opened 2026-04-23 18:12:59 -05:00 by GiteaMirror · 7 comments
GiteaMirror commented 2026-04-23 18:12:59 -05:00
Owner
Copy Link

Originally created by @JayX83 on GitHub (Dec 9, 2025).
Original GitHub issue: https://github.com/bitwarden/android/issues/6250

Origin

Native Application (non-browser app)

Web URL or App name

google.com

Passkey Action

  • Creating new passkey (Registration)
  • Signing in (Authentication)

Build Information

© Bitwarden Inc. 2015-2025

Version: 2025.11.1 (20994)
📱 samsung SM-A155F 🤖 16@36 📦 prod
🧱 commit: bitwarden/android/release/2025.11-rc39@63c4e1fe9314d2b2f2c0989b5bb8c265b3cbc57e
💻 build source: bitwarden/android/actions/runs/19583271293/attempts/2
🦀 SDK: 1.0.0-3436-2a00b727
🌩 Server: 2025.11.1 @ US

Additional Information

Steps to reproduce

  1. Install Bitwarden on Android and log in.
  2. In Bitwarden app settings enable “Use Chrome autofill integration”, and in Chrome autofill settings, ensure that "Autofill using another service" is selected.
  3. In Android passkeys & password settings, Google is also enabled as as an additional service (see screenshots).
  4. Open Chrome and log in to a Google account using a passkey. Initial login works normally.
  5. Click on the profile icon > Manage your Google account > Security & sign-in.
  6. Perform any action that triggers identity reverification with a passkey (for example accessing or attempting to change a security setting).
  7. The page switches to the reverification state and waits for a fingerprint prompt.
  8. No fingerprint or passkey UI appears. The screen stays stuck on “Verifying it's you..."

Expected result

Chrome should show the Android biometric or passkey prompt and complete reverification.

Actual result

No biometric or passkey prompt appears. The page stays stuck on verifying.

Additional notes

Disabling “Use Chrome autofill integration” fixes the issue immediately.

Initial passkey login always works. Only reverification fails.

The issue happens regardless of where the passkey is stored.

Screenshots

Image Image Image Image

Issue Tracking Info

  • I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
Originally created by @JayX83 on GitHub (Dec 9, 2025). Original GitHub issue: https://github.com/bitwarden/android/issues/6250 ### Origin Native Application (non-browser app) ### Web URL or App name google.com ### Passkey Action - [ ] Creating new passkey (Registration) - [x] Signing in (Authentication) ### Build Information © Bitwarden Inc. 2015-2025 Version: 2025.11.1 (20994) 📱 samsung SM-A155F 🤖 16@36 📦 prod 🧱 commit: bitwarden/android/release/2025.11-rc39@63c4e1fe9314d2b2f2c0989b5bb8c265b3cbc57e 💻 build source: bitwarden/android/actions/runs/19583271293/attempts/2 🦀 SDK: 1.0.0-3436-2a00b727 🌩 Server: 2025.11.1 @ US ### Additional Information **Steps to reproduce** 1. Install Bitwarden on Android and log in. 2. In Bitwarden app settings enable “Use Chrome autofill integration”, and in Chrome autofill settings, ensure that "Autofill using another service" is selected. 3. In Android passkeys & password settings, Google is also enabled as as an additional service (see screenshots). 4. Open Chrome and log in to a Google account using a passkey. Initial login works normally. 5. Click on the profile icon > Manage your Google account > Security & sign-in. 6. Perform any action that triggers identity reverification with a passkey (for example accessing or attempting to change a security setting). 7. The page switches to the reverification state and waits for a fingerprint prompt. 8. No fingerprint or passkey UI appears. The screen stays stuck on “Verifying it's you..." **Expected result** Chrome should show the Android biometric or passkey prompt and complete reverification. **Actual result** No biometric or passkey prompt appears. The page stays stuck on verifying. **Additional notes** Disabling “Use Chrome autofill integration” fixes the issue immediately. Initial passkey login always works. Only reverification fails. The issue happens regardless of where the passkey is stored. **Screenshots** <img width="1080" height="2340" alt="Image" src="https://github.com/user-attachments/assets/f15a78ec-6929-4226-be57-240084815db6" /> <img width="1080" height="2340" alt="Image" src="https://github.com/user-attachments/assets/0c330f05-283d-438f-aa9e-9a3f267a77d7" /> <img width="1080" height="2340" alt="Image" src="https://github.com/user-attachments/assets/17ff5d1a-35a1-4482-8ec6-7c7b47d61002" /> <img width="1080" height="2340" alt="Image" src="https://github.com/user-attachments/assets/73521d8e-7d13-4923-9058-acd3bcef02a0" /> ### Issue Tracking Info - [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
GiteaMirror added the bug-passkeyapp:password-manager labels 2026-04-23 18:12:59 -05:00
GiteaMirror commented 2026-04-23 18:13:01 -05:00
Author
Owner
Copy Link

@bitwarden-bot commented on GitHub (Dec 9, 2025):

Thank you for your report! We've added this to our internal board for review.
ID: PM-29479

<!-- gh-comment-id:3630985317 --> @bitwarden-bot commented on GitHub (Dec 9, 2025): Thank you for your report! We've added this to our internal board for review. ID: [PM-29479](https://bitwarden.atlassian.net/browse/PM-29479) [PM-29479]: https://bitwarden.atlassian.net/browse/PM-29479?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ
GiteaMirror commented 2026-04-23 18:13:02 -05:00
Author
Owner
Copy Link

@abergs commented on GitHub (Dec 9, 2025):

Thank you for filing this report @JayX83, we're taking a look to see if we can reproduce it.

<!-- gh-comment-id:3631092473 --> @abergs commented on GitHub (Dec 9, 2025): Thank you for filing this report @JayX83, we're taking a look to see if we can reproduce it.
GiteaMirror commented 2026-04-23 18:13:03 -05:00
Author
Owner
Copy Link

@JayX83 commented on GitHub (Dec 9, 2025):

Thank you for filing this report @JayX83, we're taking a look to see if we can reproduce it.

Thank you for looking into this. I’m not sure if this information will help or overcomplicate things, but hopefully it will be useful. For these tests, I focused on two popular browsers, especially on Samsung devices: Chrome and Samsung Internet. Before I begin, regardless of the settings, the initial Passkey authentication works perfectly fine. The issue comes up with Passkey reauthentication/reverification.

Chrome:

Only Bitwarden is enabled in Android settings

  • Initial Passkey authentication works perfectly.
  • Passkey reauthentication/reverification works perfectly.
  • Result is the same whether Chrome Autofill Integration is enabled or disabled.

Only Google enabled

  • Initial Passkey authentication works perfectly.
  • Passkey reauthentication/reverification works.
    * Option to enable third-party autofill services is grayed out/disabled.

Both enabled, Bitwarden preferred

  • Autofill Integration disabled in Bitwarden: initial Passkey authentication and Passkey reauthentication/reverification work perfectly.
    - Autofill Integration enabled in Bitwarden: initial Passkey authentication works, but Passkey reauthentication/reverification is broken.

Both enabled, Google preferred

  • Autofill Integration option is not available since Bitwarden is not set as preferred.
  • Both initial Passkey authentication and Passkey reauthentication/reverification work perfectly.

Samsung Internet:

Only Bitwarden enabled

  • Initial Passkey authentication works perfectly.
  • Passkey reauthentication/reverification works perfectly.

Only Google enabled

  • Initial Passkey authentication works perfectly.
    - Passkey reauthentication/reverification is broken.

Both enabled, Bitwarden preferred

  • Initial Passkey authentication works perfectly.
    - Passkey reauthentication/reverification is broken.

Both enabled, Google preferred

  • Initial Passkey authentication works perfectly.
    - Passkey reauthentication/reverification is broken.
<!-- gh-comment-id:3631848666 --> @JayX83 commented on GitHub (Dec 9, 2025): > Thank you for filing this report [@JayX83](https://github.com/JayX83), we're taking a look to see if we can reproduce it. Thank you for looking into this. I’m not sure if this information will help or overcomplicate things, but hopefully it will be useful. For these tests, I focused on two popular browsers, especially on Samsung devices: Chrome and Samsung Internet. Before I begin, regardless of the settings, the initial Passkey authentication works perfectly fine. The issue comes up with Passkey reauthentication/reverification. ### Chrome: **Only Bitwarden is enabled in Android settings** - Initial Passkey authentication works perfectly. - Passkey reauthentication/reverification works perfectly. - Result is the same whether Chrome Autofill Integration is enabled or disabled. **Only Google enabled** - Initial Passkey authentication works perfectly. - Passkey reauthentication/reverification works. _* Option to enable third-party autofill services is grayed out/disabled._ **Both enabled, Bitwarden preferred** - Autofill Integration disabled in Bitwarden: initial Passkey authentication and Passkey reauthentication/reverification work perfectly. **- Autofill Integration enabled in Bitwarden: initial Passkey authentication works, but Passkey reauthentication/reverification is broken.** **Both enabled, Google preferred** - Autofill Integration option is not available since Bitwarden is not set as preferred. - Both initial Passkey authentication and Passkey reauthentication/reverification work perfectly. ### Samsung Internet: **Only Bitwarden enabled** - Initial Passkey authentication works perfectly. - Passkey reauthentication/reverification works perfectly. **Only Google enabled** - Initial Passkey authentication works perfectly. **- Passkey reauthentication/reverification is broken.** **Both enabled, Bitwarden preferred** - Initial Passkey authentication works perfectly. **- Passkey reauthentication/reverification is broken.** **Both enabled, Google preferred** - Initial Passkey authentication works perfectly. **- Passkey reauthentication/reverification is broken.**
GiteaMirror commented 2026-04-23 18:13:04 -05:00
Author
Owner
Copy Link

@abergs commented on GitHub (Dec 10, 2025):

Hey @JayX83, I heard back from my colleagues who tried to repro, but couldn't:

I was able to login successfully and reverify my account following the steps the user provided
I did note that if the Google app takes over for authentication, Bitwarden will never get a shot to use its passkey. But I don’t think there is much we can do about that. The user needs to be really sure they are in Chrome and not in the Google app (which can look really similar).

I also wonder if this is at all related to the "double autofill"-setting problem that chrome introduced, where you need to enable Bitwarden both on the Android settings but also inside Chrome itself.

<!-- gh-comment-id:3635865954 --> @abergs commented on GitHub (Dec 10, 2025): Hey @JayX83, I heard back from my colleagues who tried to repro, but couldn't: > I was able to login successfully and reverify my account following the steps the user provided I did note that if the Google app takes over for authentication, Bitwarden will never get a shot to use its passkey. But I don’t think there is much we can do about that. The user needs to be really sure they are in Chrome and not in the Google app (which can look really similar). I also wonder if this is at all related to the "double autofill"-setting problem that chrome introduced, where you need to enable Bitwarden both on the Android settings but also inside Chrome itself.
GiteaMirror commented 2026-04-23 18:13:05 -05:00
Author
Owner
Copy Link

@JayX83 commented on GitHub (Dec 10, 2025):

Hey @JayX83, I heard back from my colleagues who tried to repro, but couldn't:

I was able to login successfully and reverify my account following the steps the user provided
I did note that if the Google app takes over for authentication, Bitwarden will never get a shot to use its passkey. But I don’t think there is much we can do about that. The user needs to be really sure they are in Chrome and not in the Google app (which can look really similar).

I also wonder if this is at all related to the "double autofill"-setting problem that chrome introduced, where you need to enable Bitwarden both on the Android settings but also inside Chrome itself.

I'm not totally sure what you mean by "double autofill" setting. Just to explain my side clearly, when you enable Chrome autofill integration in Bitwarden, it takes you to Chrome’s settings to adjust the required options, and this is clearly indicated there. The wording is something along the lines of allowing third party autofill services. I did not change any other settings beyond that.

If the Chrome autofill integration option in Bitwarden is turned off, everything works perfectly. As soon as it is enabled, reauthentication breaks in the exact way I described in my initial report.

<!-- gh-comment-id:3637642577 --> @JayX83 commented on GitHub (Dec 10, 2025): > Hey [@JayX83](https://github.com/JayX83), I heard back from my colleagues who tried to repro, but couldn't: > > > I was able to login successfully and reverify my account following the steps the user provided > > I did note that if the Google app takes over for authentication, Bitwarden will never get a shot to use its passkey. But I don’t think there is much we can do about that. The user needs to be really sure they are in Chrome and not in the Google app (which can look really similar). > > I also wonder if this is at all related to the "double autofill"-setting problem that chrome introduced, where you need to enable Bitwarden both on the Android settings but also inside Chrome itself. I'm not totally sure what you mean by "double autofill" setting. Just to explain my side clearly, when you enable Chrome autofill integration in Bitwarden, it takes you to Chrome’s settings to adjust the required options, and this is clearly indicated there. The wording is something along the lines of allowing third party autofill services. I did not change any other settings beyond that. If the Chrome autofill integration option in Bitwarden is turned off, everything works perfectly. As soon as it is enabled, reauthentication breaks in the exact way I described in my initial report.
GiteaMirror commented 2026-04-23 18:13:05 -05:00
Author
Owner
Copy Link

@andyplop9 commented on GitHub (Dec 10, 2025):

It also has problem with Whatsapp passkey

<!-- gh-comment-id:3638452682 --> @andyplop9 commented on GitHub (Dec 10, 2025): It also has problem with Whatsapp passkey
GiteaMirror commented 2026-04-23 18:13:08 -05:00
Author
Owner
Copy Link

@pamperer562580892423 commented on GitHub (Dec 10, 2025):

@andyplop9

It also has problem with Whatsapp passkey

There is a separate issue about that: https://github.com/bitwarden/android/issues/5329

<!-- gh-comment-id:3638534096 --> @pamperer562580892423 commented on GitHub (Dec 10, 2025): @andyplop9 > It also has problem with Whatsapp passkey There is a separate issue about that: https://github.com/bitwarden/android/issues/5329
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label app:password-manager bug-passkey
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#39372
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?