New issue
Advanced search Search tips

Issue 777878 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 126398
Owner: ----
Closed: Oct 2017
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug-Security



Sign in to add a comment

It's possible to see saved pwd using javascript and consol

Reported by elghayan...@gmail.com, Oct 24 2017

Issue description

UserAgent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36

Steps to reproduce the problem:
1. connect to website with already saved password
2. open console
3. type $("[type=password]")[0].type = "text";
4. password became visible

What is the expected behavior?
i expected that for security reason paswword input should be cleared once we changed the type

What went wrong?
security is not good

Did this work before? N/A 

Chrome version: 54.0.2840.71  Channel: n/a
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
Flash Version: Shockwave Flash 27.0 r0
 
Mergedinto: 126398
Status: Duplicate (was: Unconfirmed)
Yes, it's possible, and that's not a bug.
https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#What-about-unmasking-of-passwords-with-the-developer-tools
Project Member

Comment 2 by sheriffbot@chromium.org, Jan 31 2018

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment