Chrome Canary displays saved passwords in plain text
Reported by
toby07...@gmail.com,
Oct 3 2017
|
||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3231.0 Safari/537.36 Steps to reproduce the problem: 1. Go to a website with a previously saved login info 2. The fields will display highlighted pale yellow with info filled in, crucially, the password is shown in plain text 3. Clicking the password field changes it back to "...." What is the expected behavior? Instead of "....." the passwords show up in plain text! What went wrong? Saved passwords are shown in plain text, allowing anybody overlooking the screen to read it off for any website I visit. This seems to have started today. Did this work before? Yes Most recent prior to today's as far as I know Chrome version: 63.0.3231.0 Channel: canary OS Version: 10.0 Flash Version: Urgently should be addressed as it is a serious security problem!
,
Oct 3 2017
It's already fixed. I reverted the culprit earlier today. Thanks
,
Oct 3 2017
On my phone but I'll link to the revert when I get to a computer.
,
Oct 3 2017
The next Canary cut will have it fixed, so probably tomorrow. This issue does not affect Chrome users, it only affected the top of tree and today's Canary.
,
Oct 4 2017
Just encountered this right now before updating to Version 63.0.3232.0 (Official Build) canary (64-bit). Can confirm that it's fixed now but I have to admit that I am a bit freaked out about the fact that this slipped into a release.
,
Oct 4 2017
Same here! I was freaking out thinking my machine was compromised. This should never happen and passwords should always be encrypted.
,
Oct 4 2017
Thanks, Seb, for the fast fix. Note that this is why we have channels like Canary, to quickly catch issues like this and get them fixed. Canary is the wild west for us. :) Thanks for reporting!
,
Oct 5 2017
,
Oct 7 2017
Issue 772479 has been merged into this issue. |
||
►
Sign in to add a comment |
||
Comment 1 by och...@chromium.org
, Oct 3 2017Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Bug
Status: (was: Unconfirmed)