Calling startOAuth2Authentication browser never closes and return to my app

Update

After many tests I found that the Browser on the device is outdated.  I installed the latest Chrome browser and the problem still persist.  The only browser that is working is Firefox.

Is there problem with Dropbox api and specific version of the browser/Android OS?

----------------------------------------------------

I have custom Android  device running api 22. It does not have the normal Android OS version number. eg: 5.0.xxx   It is customized.  My app is using Dropbox api v2.

compile 'com.dropbox.core:dropbox-core-sdk:3.1.3'

android {
    compileSdkVersion 28
    defaultConfig {
        applicationId "com.quirklogic.dropboxdemo"
        minSdkVersion 21
        targetSdkVersion 28
        versionCode 1
        versionName "1.0"
         testInstrumentationRunner "android.support.test.runner.AndroidJUnitRunner"
    }
    buildTypes {
        release {
            minifyEnabled false
            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
        }
    }
}

When I call

Auth.startOAuth2Authentication(getApplicationContext(), getString(DROPBOX_APP_KEY));

The browser is opened and when I entered my email and password to authenticate there are is error.  It never shows the permission screen and the browser never closes and return to my app.

I do get logcat errors.

03-03 13:56:02.805 3531-3531/com.android.browser I/browser: Console: The Content-Security-Policy directive 'base-uri' is implemented behind a flag which is currently disabled.
     https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LeQblAUAAAAAHIxpoTyzyKHd_2AbdDjSGcyhHSJ&co=aHR0cHM6Ly93d3cuZHJvcGJveC5jb206NDQz&hl=en&v=v1QHzzN92WdopzN_oD7bUO2P&size=invisible&sa=LOGIN&cb=2xdliulnzfg9:0
03-03 13:56:03.213 3531-3531/com.android.browser I/browser: Console: The Content-Security-Policy directive 'base-uri' is implemented behind a flag which is currently disabled.
     about:blank:0
03-03 13:56:03.214 3531-3531/com.android.browser I/browser: Console: The Content-Security-Policy directive 'base-uri' is implemented behind a flag which is currently disabled.
     about:blank:0
03-03 13:56:03.664 3531-3531/com.android.browser I/browser: Console: The Content-Security-Policy directive 'base-uri' is implemented behind a flag which is currently disabled.
     about:blank:0
03-03 13:56:03.667 3531-3531/com.android.browser I/browser: Console: The Content-Security-Policy directive 'base-uri' is implemented behind a flag which is currently disabled.
     about:blank:0
03-03 13:56:03.751 3531-3531/com.android.browser E/browser: Console: Warning: StoreListener(Unknown): isMounted is deprecated. Instead, make sure to clean up subscriptions and pending requests in componentWillUnmount to prevent memory leaks. https://cfl.dropboxstatic.com/static/js/packaged/pkg-react-libs.min-vflFbcDTf.js:1

I have tested the same app on Android OS7+ and it works fine and the browser ask for permission and then returns to my app.

If have select to sign in using Google account and then select an account from the list then it works.  It will NOT work if I authenticate using userid/password.

I have also tried the sample app here and it does not work either.

https://github.com/dropbox/dropbox-sdk-java/tree/master/examples/android/src/main/java/com/dropbox/core/examples/android