Issue metadata
Sign in to add a comment
|
Security: viewing autofill hidden passwords
Reported by
mtaffel...@gmail.com,
Aug 7 2017
|
||||||||||||||||||||
Issue descriptionVULNERABILITY DETAILS When using Chrome's autofill feature for password logins the password can be seen by anyone if they use dev tools (inspect) to change: input type="password" to something else, for example input type="anything". VERSION Chrome Version: 60.0.3112.90 (Official Build) (64-bit) Operating System: Windows 10 REPRODUCTION CASE 1) Go to a sign in page that has a hidden password autofilled out. 2) inspect the password field <input type="password" id="ap_password" name="password" tabindex="2" class="a-input-text a-span12 auth-autofocus auth-required-field"> 3) change the type from "password" to something else 4) you will now be able to see the password. FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION N\A
,
Nov 14 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||
Comment 1 by elawrence@chromium.org
, Aug 7 2017Status: Duplicate (was: Unconfirmed)