TrustedBrowsers.kt

1package com.peachpasswords.autofill23/**4 * Conservative allowlist of apps permitted to request autofill for a *web* origin5 * (MF-7). When an autofill request carries a webDomain, the providing app must be a6 * known browser — otherwise a malicious app could claim `bank.com` and harvest the7 * credentials it does not own. Native-app autofill (no webDomain) is unaffected.8 *9 * [NEEDS EXPANSION] — add browsers as needed; an unknown browser simply gets no10 * web autofill until it is listed (it can still be used via the manual picker).11 */12object TrustedBrowsers {13    private val KNOWN_BROWSERS = setOf(14        "com.android.chrome",15        "com.chrome.beta",16        "com.chrome.dev",17        "org.mozilla.firefox",18        "org.mozilla.firefox_beta",19        "com.brave.browser",20        "com.microsoft.emmx",        // Edge21        "com.opera.browser",22        "com.opera.mini.native",23        "com.vivaldi.browser",24        "com.kiwibrowser.browser",25        "com.duckduckgo.mobile.android",26        "com.sec.android.app.sbrowser", // Samsung Internet27        "com.android.browser",28    )2930    fun isTrusted(packageName: String?): Boolean = packageName in KNOWN_BROWSERS31}