Unfortunatately, the Android framework sometimes creates its own
Window
instances, such as the drop-down in an AutoCompleteTextView
. Even if you
set FLAG_SECURE
on the Window
for an activity, the Android framework
does not pass that flag to any other windows created on behalf of that
activity. This affects not just AutoCompleteTextView
, but Spinner
, the action bar overflow menu, and lots of other things.
Authors of widgets or other UI elements that show their own windows need to:
Examine the activity that those elements are a part of and see if that
activity is using FLAG_SECURE
to protect its contents. If it is,
the UI element needs to apply FLAG_SECURE
to any windows it opens up on behalf of that activity, such as a popup,
so that the entire activity UI is secure.
Or, the UI element needs to expose the Window
objects via a public
API, so that FLAG_SECURE
can be applied where needed.
I have more about the scope of the problem, and some workarounds,
in my CWAC-Security library.
Thanks for pointing this out!
FLAG_SECURE
does not cascade to child windows, or not all child windows. If you have any dialogs in your app, you might try those as well, as they too represent child windows. I don't see any outstanding bug reports related to this. What device are you testing on, and what version of Android is it running?