This bug is about password text fields on the web, e.g. <input type=password>, when TalkBack is enabled.

Prior to O, Android used a setting that controlled whether the text of a password was read out or not. If it said that passwords should be read out, Chrome would expose the text to accessibility services regardless of whether the text was shown. If it said to obscure passwords, we'd only expose a string of dots.

Starting with O, the behavior has changed. Now there's a system setting that controls whether characters in passwords should be shown briefly, or not at all, and Chrome is supposed to just expose whatever is visible - whether a character or a dot.

HOWEVER (and this part isn't documented anywhere), we're not supposed to fire any events when a character is replaced with a dot, otherwise TalkBack announces that change.

Here's a quick test of all of the permutations and what should happen:

Settings > Security & Location > Show Passwords OFF
  1. Type a character in a password field - should hear character first
     (from keyboard), then "dot".
  2. Delete a character - should hear "dot deleted"
  3. Press volume keys to navigate through characters - should hear
     "dot"
  4. Move focus away and back to password, should hear something like
     "three dots"

Settings > Security & Location > Show Passwords ON
  1. Type a character in a password field - should hear character twice -
     once from keyboard, once from text field. Visually, character changes
     to a dot, but nothing should be announced.
  2. Delete a character - should hear "dot deleted", you should not hear the
     character again because it was replaced with a dot after a short delay
  3. Press volume keys to navigate through characters - should hear
     "dot" because characters were all replaced with dots
  4. Move focus away and back to password, should hear something like
     "eight dots"