I am guessing (hoping?) that stock Compose widgets will not create child windows, the way

Spinner

,

AutoCompleteTextView

,

PopupWindow

, and various other things did in classic framework widgets. But, if anyone finds that they need a child window... please propagate

FLAG_SECURE

. If the activity's window has

FLAG_SECURE

, child windows need

FLAG_SECURE

. For more, see: - https://blog.doyensec.com/2019/08/22/modern-password-managers-flag-secure.html (password managers getting burned by this) - https://commonsware.com/blog/2016/06/06/psa-flag-secure-window-leaks.html (my original blog post on the subject)