On new Android devices which use file-based encryption (available in Android 7.0 and up, but the vendor decides which encryption mechanism to use), all data stored by applications is already encrypted using per-user encryption keys. This includes your Nexus 5X. The database can only be read once the user's unlock code has been entered, even with root.

Also, rooted devices are outside of Android's security model; secure devices are not expected to permit any application (or the user) to have root access at all.

On earlier versions of Android which use full-disk encryption, the entire storage (for all users) is unlocked at boot, not just the specific user who unlocked the device, and that's about the best it can do. The app sandbox still prevents users from accessing each others' data, however.

Older devices that don't use encryption at all are just out of luck.

Android does not have a platform-specific app-accessible encryption method like the one used internally by Chrome on other OSes, so that's not applicable here.

Hello, Thank you for your quick response 

My question is : is there any way to invoke cookies' encryption routine implemented on chromium based webview- from my android application ?
what should i tell clients that have their session http-only cookies plain text in Cookie data bases on their Nexus 5X android 7.0 phones ?  


Any Help In Appreciated !! 
Thank you in Advance

This is basically reiterating what Torne wrote.

No. There is no way to invoke the chromium cookie encryption code on Android, but even ifyou could enable this feature it would not provide any additional security.

If you read https://bugs.chromium.org/p/chromium/issues/detail?id=313323#c15 you'll see that the decision has been made not to enable this feature on Android, in favour of the OS level protection.

Full disk encryption has been mandated since M, and file based encryption since N. This protects data when the user has not authenticated to the device. FBE also encrypts data with different keys per user. Application data directories are also not accessible by other running applications.

In the case of a privilege escalation on the device it would not matter if the cookie jar was encrypted, because the malicious code can control your application to exfiltrate cookie jar contents, using that encryption key to obtain plain text data if necessary.

ok thx 
had to be sure !!