[PM-29479] Bitwarden Android app interferes with Google passkey reverification

[JayX83]

Origin

Native Application (non-browser app)

Web URL or App name

google.com

Passkey Action

• Creating new passkey (Registration)
• Signing in (Authentication)

Build Information

© Bitwarden Inc. 2015-2025

Version: 2025.11.1 (20994)
📱 samsung SM-A155F 🤖 16@36 📦 prod
🧱 commit: 63c4e1f
💻 build source: bitwarden/android/actions/runs/19583271293/attempts/2
🦀 SDK: 1.0.0-3436-2a00b727
🌩 Server: 2025.11.1 @ US

Additional Information

Steps to reproduce

1. Install Bitwarden on Android and log in.
2. In Bitwarden app settings enable “Use Chrome autofill integration”, and in Chrome autofill settings, ensure that "Autofill using another service" is selected.
3. In Android passkeys & password settings, Google is also enabled as as an additional service (see screenshots).
4. Open Chrome and log in to a Google account using a passkey. Initial login works normally.
5. Click on the profile icon > Manage your Google account > Security & sign-in.
6. Perform any action that triggers identity reverification with a passkey (for example accessing or attempting to change a security setting).
7. The page switches to the reverification state and waits for a fingerprint prompt.
8. No fingerprint or passkey UI appears. The screen stays stuck on “Verifying it's you..."

Expected result

Chrome should show the Android biometric or passkey prompt and complete reverification.

Actual result

No biometric or passkey prompt appears. The page stays stuck on verifying.

Additional notes

Disabling “Use Chrome autofill integration” fixes the issue immediately.

Initial passkey login always works. Only reverification fails.

The issue happens regardless of where the passkey is stored.

Screenshots

Issue Tracking Info

• I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

[bitwarden-bot]

Thank you for your report! We've added this to our internal board for review.
ID: PM-29479

[abergs]

Thank you for filing this report @JayX83, we're taking a look to see if we can reproduce it.

[JayX83]

Thank you for filing this report @JayX83, we're taking a look to see if we can reproduce it.

Thank you for looking into this. I’m not sure if this information will help or overcomplicate things, but hopefully it will be useful. For these tests, I focused on two popular browsers, especially on Samsung devices: Chrome and Samsung Internet. Before I begin, regardless of the settings, the initial Passkey authentication works perfectly fine. The issue comes up with Passkey reauthentication/reverification.

Chrome:

Only Bitwarden is enabled in Android settings

• Initial Passkey authentication works perfectly.
• Passkey reauthentication/reverification works perfectly.
• Result is the same whether Chrome Autofill Integration is enabled or disabled.

Only Google enabled

• Initial Passkey authentication works perfectly.
• Passkey reauthentication/reverification works.
  * Option to enable third-party autofill services is grayed out/disabled.

Both enabled, Bitwarden preferred

• Autofill Integration disabled in Bitwarden: initial Passkey authentication and Passkey reauthentication/reverification work perfectly.
  - Autofill Integration enabled in Bitwarden: initial Passkey authentication works, but Passkey reauthentication/reverification is broken.

Both enabled, Google preferred

• Autofill Integration option is not available since Bitwarden is not set as preferred.
• Both initial Passkey authentication and Passkey reauthentication/reverification work perfectly.

Samsung Internet:

Only Bitwarden enabled

• Initial Passkey authentication works perfectly.
• Passkey reauthentication/reverification works perfectly.

Only Google enabled

• Initial Passkey authentication works perfectly.
  - Passkey reauthentication/reverification is broken.

Both enabled, Bitwarden preferred

• Initial Passkey authentication works perfectly.
  - Passkey reauthentication/reverification is broken.

Both enabled, Google preferred

• Initial Passkey authentication works perfectly.
  - Passkey reauthentication/reverification is broken.

[abergs]

Hey @JayX83, I heard back from my colleagues who tried to repro, but couldn't:

I was able to login successfully and reverify my account following the steps the user provided
I did note that if the Google app takes over for authentication, Bitwarden will never get a shot to use its passkey. But I don’t think there is much we can do about that. The user needs to be really sure they are in Chrome and not in the Google app (which can look really similar).

I also wonder if this is at all related to the "double autofill"-setting problem that chrome introduced, where you need to enable Bitwarden both on the Android settings but also inside Chrome itself.

[JayX83]

Hey @JayX83, I heard back from my colleagues who tried to repro, but couldn't:

I was able to login successfully and reverify my account following the steps the user provided
I did note that if the Google app takes over for authentication, Bitwarden will never get a shot to use its passkey. But I don’t think there is much we can do about that. The user needs to be really sure they are in Chrome and not in the Google app (which can look really similar).

I also wonder if this is at all related to the "double autofill"-setting problem that chrome introduced, where you need to enable Bitwarden both on the Android settings but also inside Chrome itself.

I'm not totally sure what you mean by "double autofill" setting. Just to explain my side clearly, when you enable Chrome autofill integration in Bitwarden, it takes you to Chrome’s settings to adjust the required options, and this is clearly indicated there. The wording is something along the lines of allowing third party autofill services. I did not change any other settings beyond that.

If the Chrome autofill integration option in Bitwarden is turned off, everything works perfectly. As soon as it is enabled, reauthentication breaks in the exact way I described in my initial report.

[andyplop9]

It also has problem with Whatsapp passkey

[pamperer562580892423]

@andyplop9

It also has problem with Whatsapp passkey

There is a separate issue about that: #5329