[PM-41059] fix: CXF import crash when credential timestamps contain negative values (e.g., Windows FILETIME epoch -11644473600 from Google Password Manager exports). by crosenth · Pull Request #7216 · bitwarden/android

crosenth · 2026-07-28T16:14:53Z

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-40542

📔 Objective

Fixes bug:

Stacktrace:
com.bitwarden.sdk.BitwardenException$Export: v1=com.bitwarden.exporters.ExportException$Cxf: Credential Exchange error: JSON error: invalid value: integer -11644473600, expected u64 at line 1 column 61701
com.bitwarden.sdk.FfiConverterTypeBitwardenError.read(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:174)
com.bitwarden.sdk.FfiConverterTypeBitwardenError.read(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:515)
com.bitwarden.sdk.FfiConverter$DefaultImpls.liftFromRustBuffer(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:11)
com.bitwarden.sdk.FfiConverterRustBuffer$DefaultImpls.liftFromRustBuffer(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:4)
com.bitwarden.sdk.FfiConverterTypeBitwardenError.liftFromRustBuffer(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:1)
com.bitwarden.sdk.FfiConverterTypeBitwardenError.liftFromRustBuffer(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:8)
com.bitwarden.sdk.FfiConverterRustBuffer$DefaultImpls.lift(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:4)
com.bitwarden.sdk.FfiConverterTypeBitwardenError.lift(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:1)
com.bitwarden.sdk.FfiConverterTypeBitwardenError.lift(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:8)
com.bitwarden.sdk.BitwardenException$ErrorHandler.lift(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:6)
com.bitwarden.sdk.BitwardenException$ErrorHandler.lift(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:13)
com.bitwarden.sdk.Bitwarden_uniffiKt.uniffiCheckCallStatus(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:79)
com.bitwarden.sdk.Bitwarden_uniffiKt.access$uniffiCheckCallStatus(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:1)
com.bitwarden.sdk.ExporterClient.importCxf(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:66)
rpb.Z(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:75)
db2.a(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:133)
hnb.T(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:91)
br4.invokeSuspend(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:51)
vo0.resumeWith(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:8)
qw2.run(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:114)
qb3.t0(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:24)
ng1.o(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:93)
ng1.s(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:3)
l41.a(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:7)
j41.R(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:69)
j41.d(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:53)
j41.b(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:104)
com.bitwarden.ui.platform.base.BaseViewModel.trySendAction(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:3)
ip.invokeSuspend(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:1362)
vo0.resumeWith(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:8)
qw2.run(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:114)
xr.p0(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:24)
wr.run(r8-map-id-3711f003cf7d2a46fb8ec7e8ada71c46655423e03b475b325f07a00886353258:3)
android.os.Handler.handleCallback(Handler.java:1095)
android.os.Handler.dispatchMessageImpl(Handler.java:135)
android.os.Handler.dispatchMessage(Handler.java:125)
android.os.Looper.loopOnce(Looper.java:296)
android.os.Looper.loop(Looper.java:397)
android.app.ActivityThread.main(ActivityThread.java:9523)
java.lang.reflect.Method.invoke(Native Method)
com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:575)
com.android.internal.os.ZygoteInit.main(ZygoteInit.java:939)

Version: 2026.6.1 (21713)
Device: 📱 google Pixel 9 🤖 17@37 📦 prod
CI: 🧱 commit: e5ee43f
💻 build source: bitwarden/android/actions/runs/28253991408/attempts/1

CLAassistant · 2026-07-28T16:15:25Z

All committers have signed the CLA.

bitwarden-bot · 2026-07-28T16:15:44Z

Thank you for your contribution! We've added this to our internal tracking system for review.
ID: PM-41059
Link: https://bitwarden.atlassian.net/browse/PM-41059

Details on our contribution process can be found here: https://contributing.bitwarden.com/contributing/pull-requests/community-pr-process.

david-livefront · 2026-08-05T17:32:25Z

        val allCiphers = accountsJsonList.flatMap { accountJson ->
            vaultSdkSource
-                .importCxf(userId = userId, payload = accountJson)
+                .importCxf(userId = userId, payload = sanitizeTimestamps(accountJson))


Instead of modifying the values received here, it would be better to push this into the SDK so all platforms can get the benefits of this update.

We could apply it in this same way or possibly make the data type signed.

Let me know if this works:

bitwarden/sdk-internal#1362

Works for me!

The version of the SDK that contains this fix is already merged into the app. It should make it out to the public in the 2026.8.1 release.

Some credential managers (e.g., Google Password Manager) export creationAt/modifiedAt as the Windows FILETIME epoch (-11644473600) when no real date exists. The credential-exchange-format crate deserializes these fields as u64 and rejects negative values. Sanitize the JSON payload before deserialization by clamping negative timestamp values to `null`. ## 🎟️ Tracking bitwarden/android#7140 bitwarden/android#7215 bitwarden/android#7216 https://bitwarden.atlassian.net/browse/PM-40542 ## 📔 Objective ## Summary - Sanitize negative `creationAt`/`modifiedAt` values in CXF payloads before deserialization, clamping them to `null` - Fixes import failures from Google Password Manager on devices where credentials have no real creation/modification date (exported as the Windows FILETIME epoch: -11644473600) ## Root cause The `credential-exchange-format` crate defines these fields as `Option<u64>`, which cannot represent negative values. The fix pre-processes the JSON in `parse_cxf()` before the typed deserialization step. ## Test plan - Added unit tests for `sanitize_timestamps()` covering negative, valid, and mixed timestamp values - Added integration test confirming `parse_cxf()` succeeds with negative timestamps in the payload --------- Co-authored-by: John Harrington <84741727+harr1424@users.noreply.github.com>

axiqom · 2026-08-26T16:44:50Z

Corroborating data point on a newer build, with a different negative timestamp
than the one in the description — which I think validates the general
-\d+ approach in this patch over special-casing -11644473600.

Bitwarden Android: 2026.7.1 (21803) (release/2026.7-rc59@abb9dde)
Device: Sony XQ-EC72, Android 16 (API 36), prod
Source: Google Password Manager, via Settings → Vault → Import → Import from another app

com.bitwarden.sdk.BitwardenException$Export: v1=com.bitwarden.exporters.ExportException$Cxf:
Credential Exchange error: JSON error: invalid value: integer `-10097426689`,
expected u64 at line 1 column 3163
	...
	com.bitwarden.sdk.ExporterClient.importCxf(...:66)

-10097426689 interpreted as epoch milliseconds is 1969-09-06T03:09:33Z —
a pre-epoch date, but not the Windows FILETIME offset. So this is not a single
magic constant leaking through; Google Password Manager emits a range of
negative values for credentials with no valid date. Any fix keyed to
-11644473600 specifically would not have covered this case.

One question on scope: the regex covers creationAt and modifiedAt. Are there
other CXF fields deserialized as u64 that could carry a negative value? The
failure here is at column 3163, and I don't have the payload to confirm which
field it was, since the Android Credential Exchange handoff is in-memory and
never lands on disk.

Also worth noting for triage: #7175 is the matching report and was closed as
not_planned (duplicate of #7140), but #7140 is a different symptom and its
reporter said they could no longer reproduce it. This crash has no open tracking
issue as a result, which may be why this PR has been sitting.

Filed as #7311 so this has an open tracking issue.

Fix CXF import crash when credential timestamps contain negative values

89c3f26

crosenth requested review from a team and david-livefront as code owners July 28, 2026 16:14

bitwarden-bot added community-pr needs-qa labels Jul 28, 2026

crosenth mentioned this pull request Jul 28, 2026

[PM-40542] Google Password Manager: "Unable to import your items" #7175

Closed

1 task

This was linked to issues Jul 28, 2026

[PM-39931] "Import from another app" only evokes an error message #7140

Open

[PM-41044] Passkeys import from other app doesn't work on Android 17 #7215

Open

Merge branch 'main' into main

9fe4a97

david-livefront reviewed Aug 5, 2026

View reviewed changes

crosenth mentioned this pull request Aug 7, 2026

[PM-41690] fix: CXF import crash on negative timestamps bitwarden/sdk-internal#1362

Merged

axiqom mentioned this pull request Aug 26, 2026

[PM-42529] CXF import from Google Password Manager fails: negative timestamp, 'expected u64' (2026.7.1) #7311

Closed

Navigation Menu

Uh oh!

[PM-41059] fix: CXF import crash when credential timestamps contain negative values (e.g., Windows FILETIME epoch -11644473600 from Google Password Manager exports). - #7216

[PM-41059] fix: CXF import crash when credential timestamps contain negative values (e.g., Windows FILETIME epoch -11644473600 from Google Password Manager exports).#7216
crosenth wants to merge 2 commits into
bitwarden:mainfrom
crosenth:main

crosenth commented Jul 28, 2026

Uh oh!

CLAassistant commented Jul 28, 2026 •

edited

Loading

Uh oh!

bitwarden-bot commented Jul 28, 2026

Uh oh!

david-livefront Aug 5, 2026

Uh oh!

crosenth Aug 7, 2026 •

edited

Loading

Uh oh!

david-livefront Aug 26, 2026

Uh oh!

axiqom commented Aug 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

crosenth commented Jul 28, 2026

🎟️ Tracking

📔 Objective

Uh oh!

CLAassistant commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bitwarden-bot commented Jul 28, 2026

Uh oh!

david-livefront Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

crosenth Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

david-livefront Aug 26, 2026

Choose a reason for hiding this comment

Uh oh!

axiqom commented Aug 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

CLAassistant commented Jul 28, 2026 •

edited

Loading

crosenth Aug 7, 2026 •

edited

Loading