Able to reproduce the issue on mac 10.11.5 chrome version with a sample form https://whytls.com/password.htm - Observed that value of input is not visible to DOM.

Please find the screenshot for comparison between firefox and chrome

Confirming the issue for further inputs on this

vabr@, Could you please confirm if this is similar to  issue 636461 

Thanks for the report. This is a security measure, working as intended. The password value becomes visible to JS as soon as the user interacts with the page in any way (clicks anywhere or types into the page).

@tkonchada: no, this has nothing to do with  issue 636461 .

Removing RVG, because there is nothing confidential in this report.

I'd like to lay out a reason for changing this behavior: AJAX signing forms.

When I load up a validation script, Chrome (and only Chrome) shows password fields that have been autofilled as invalid, giving the user an error message saying the field is empty. Because it's being report by Chrome as empty. Users who use autofill want to be able to just click the submit button and go, but they load the page and get a big red X which shouldn't be there.

This is broken behavior. It's also not any more secure, because the moment a user interacts with the field, the password is visible anyway.

For reference:

http://stackoverflow.com/questions/35049555/chrome-autofill-autocomplete-no-value-for-password

So you're just not even going to respond, vabr@?

I think this should be reconsidered. This provides a fairly small amount of protection. It's true that that a malicious site could create an iframe to another domain and stealing the user's password. But that site just has to get the user to click on the iframe and the password is given up.

It would be better if Chrome simply did not to auto-fill passwords in iframes opened to other domains. Then this limitation wouldn't be necessary.

At a minimum, you could set the validity property immediately, not after the click. Then even when the value property is empty unset, form validation could at least detect that the field is will have a value.

I don't think google looks at issues once the status is WontFix. But I think there are good arguments for reconsidering that stance. I've opened a new issue: https://bugs.chromium.org/p/chromium/issues/detail?id=669724 Please star the issue if you want Google to take notice.