qml: protect Address Private Keys from screenshots
What the developer wrote
Authored by f321x
qml: protect Address Private Keys from screenshots
Address private keys weren't protected from screenshots.
What changed, and why it matters
This commit fixes a privacy gap in Electrum's mobile-style QML user interface. Previously, when you opened the details for a Bitcoin address and viewed its private key, the app window was not marked as 'secure,' meaning another app or the operating system could take a screenshot or screen recording of the private key. The change tells the app controller to protect the window from screenshots whenever a private key is being shown. This reduces the risk that malware or a compromised helper app could steal the key by capturing the screen.
Apply the patch. Verify that AppController.secureWindow correctly maps to OS-level screenshot protection on all targeted platforms (especially Android). Consider extending the same protection to any other QML views that display seed phrases, private keys, or other high-sensitivity wallet material. No immediate incident response is indicated unless users viewed private keys on a compromised or shared device before patching.
Security signals we found
Private key material displayed in UI without screenshot protection
Addition of secureWindow binding tied to private key visibility
Privacy/confidentiality hardening in wallet GUI
No cryptographic or network vulnerability; UI exposure control
Evidence from the diff
In electrum/gui/qml/components/AddressDetails.qml, a QML Binding is added that binds AppController.secureWindow to the truthiness of addressdetails.privkey. When the address details pane has loaded/displayed a private key, secureWindow becomes true, which presumably triggers platform-level screenshot/screen-recording protection (e.g., FLAG_SECURE on Android or equivalent). Before this change, viewing a private key in the QML address details did not set this flag, leaving the window capturable.
Changed components
electrum/gui/qml/components/AddressDetails.qmlQML address details private key displayAppController.secureWindow screenshot-protection mechanismInspect captured patch +6 / −0
diff --git a/electrum/gui/qml/components/AddressDetails.qml b/electrum/gui/qml/components/AddressDetails.qml
index 3d71c71..b631e4b 100644
--- a/electrum/gui/qml/components/AddressDetails.qml
+++ b/electrum/gui/qml/components/AddressDetails.qml
@@ -346,4 +346,10 @@ Pane {
dialog.open()
}
}
+
+ Binding {
+ target: AppController
+ property: 'secureWindow'
+ value: Boolean(addressdetails.privkey)
+ }
}
Why this scored 48/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.