VULNERABILITY DETAILS
Autofill data can be obtained without system password. Although the attack 
vector is small and requires access to a user's Chrome Browser physically the data in Autofill can be obtained without having the system password. Which is prompted in the
settings page chrome://settings/passwords if the user wants to see the plaintext
values. [Screenshot 1]

VERSION
Chrome Version: 56.0.2924.87 (64-bit) + stable
Operating System: macOS Sierra 10.12.3

REPRODUCTION CASE
1. Go to a website that the user has previously saved sensitive data in autofill. [Screenshot 2]
2. Open the developer console and go to the network tab.
3. Click sign in and inspect the request sent by the browser to login [Screenshot 3]
4. You should see the username and password in plaintext.

The same can be used to get credit card values from autofill.

Thanks,
 

Deleted: Screenshot1.png 372 KB

	Screenshot1.png 372 KB View Download

Deleted: Screenshot2.png 816 KB

	Screenshot2.png 816 KB View Download

Deleted: Screenshot3.png 399 KB

	Screenshot3.png 399 KB View Download