[PM-43211] Recognize HTML card hints in Android autofill

[erabti]

🎟️ Tracking

Reproduced Android card-autofill failure on the Arabic Moamalat payment form (npg.moamalat.net). Switching the same form to English makes the card picker work. Related community report: https://community.bitwarden.com/t/credit-card-autofill-issue-with-website-in-language-other-than-english/93355 (not claiming identical underlying behavior).

📔 Objective

Recognize HTML card autocomplete tokens supplied directly in AssistStructure.ViewNode.autofillHints, without relying on an English label or placeholder.

On Pixel 10 Pro / Android 17, Bitwarden 2026.8.0, Chrome 152.0.7977.76, the Arabic card-number field offers no cards. Expiration/security-code fields open a login picker instead. Chrome's third-party autofill integration is enabled. Sanitized Android structure inspection confirms the card field reaches Android with autofillHints=[cc-number], a localized hint, and HTML attributes id=cc-number, name=cardNumber, type=text.

The source HTML includes:

<input type="ccnum" inputmode="numeric" name="cardNumber"
       autocomplete="cc-number" id="cc-number" placeholder="رقم البطاقة">

Chrome normalizes the unknown input type to text. Changing that type alone did not fix recognition. A fresh field with the English placeholder Card number opened the card picker, and the reporter independently confirmed that the site's normal English-language option works after refresh. No payment was submitted. These are observations of the released app, not validation of a patched APK.

The current explicit-hint allowlist accepts Android's creditCardNumber, but not the HTML cc-number token observed in the Android structure. Once rejected, matching falls back to heuristic labels. This patch accepts the seven standard HTML card hints (cc-number, cc-exp, cc-exp-month, cc-exp-year, cc-csc, cc-name, cc-type) and maps them to the existing Card partitions before those heuristics. It retains the order of supported hints and leaves unknown hints unsupported. No URI matching, vault schema, credential storage, or new dependency changes.

Validation

• Added regression coverage for all seven HTML card hints with a localized label and both identity-autofill flag states.
• Added checks for security-code hints taking precedence over password heuristics, unknown hints, and supported-hint ordering.
• git diff --check passed.
• Unit tests and detekt have not run successfully. The local checkout lacks Android SDK 37 and the required build dependencies. The pinned Gradle 9.7.0 download was interrupted before completion; an explicitly offline attempt with installed Gradle 9.7.1 failed during configuration because Android Gradle Plugin 9.3.2 was not cached. No dependency versions or locks were changed to work around this.
• Intended targeted command: ./gradlew :app:testStandardDebugUnitTest --tests 'com.x8bit.bitwarden.data.autofill.util.ViewNodeExtensionsTest'.
• Draft pending CI, review, and testing the patched app against the Arabic form. Does not claim every field on that form is fixed when it has no explicit hint.

Prepared with AI assistance from reporter-confirmed device behavior and sanitized field metadata. No vault contents, payment details, screenshots, or private diagnostics are included.

[bitwarden-bot]

Thank you for your contribution! We've added this to our internal Community PR board for review.
ID: PM-43211
Link: https://bitwarden.atlassian.net/browse/PM-43211

Details on our contribution process can be found here: https://contributing.bitwarden.com/contributing/pull-requests/community-pr-process.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}