VULNERABILITY DETAILS
I think exposure of password in network requests will be quite easy to identify a user's password. I have been thinking of this for a long time like how not show user's password in a network request. I thought of how google does but unfortunately, I am able to see my password in the network request. I am attaching my screenshot for reference. Probably I think some feature should be added so that password will be masked when sending a request.

VERSION
Chrome Version: 56.0.2924.87
Operating System: Windows 7

REPRODUCTION CASE
Just try logging into Gmail with Network tab opened and see a request called password. In that, you can see your own password without any masking