fix: Block unverified web autofill credential release (v2.14.73) Preserve a fail-closed trust decision from origin resolution through every autofill response, picker, and save sink. Repair the malicious companion form so device automation proves the denial path is exercised. Verification: focused regression tests passed; full JVM suite passed; lintDebug passed after a transient FIR analyzer retry; assembleRelease passed.
$ koh steal kepr.uk/peach-android@1009fd2d3ebd
·
parent: 4b3185755696
discussion
log in to leave a comment.