This template is ONLY for reporting security bugs. If you are reporting a
Download Protection Bypass bug, please use the "Security - Download
Protection" template. For all other reports, please use a different
template.

Please READ THIS FAQ before filing a bug: https://chromium.googlesource.com
/chromium/src/+/master/docs/security/faq.md

Please see the following link for instructions on filing security bugs:
https://www.chromium.org/Home/chromium-security/reporting-security-bugs

NOTE: Security bugs are normally made public once a fix has been widely
deployed.

VULNERABILITY DETAILS
Please provide a brief explanation of the security issue.

When logging into Chrome browser on a 3rd party computer (friend or public), saved login / password combinations are transferred to my personal Google account and can be accessed in plain text. 

This allows me login to other user's accounts on 3rd party websites where they have saved passwords. 

As an example, I recently logged into Chrome on a friend's laptop to check email and do some banking. When I finished the session, I logged out of Chrome. 

Now, when I visit passwords.google.com, I see username & password details for many users from that computer (see screenshot hellomattswitzer@gmail.com, cherylswitzer1@gmail.com, etc)

VERSION
Chrome Version: 
Version 65.0.3325.181 (Official Build) (64-bit)
Operating System: Any OS

REPRODUCTION CASE
Please include a demonstration of the security bug, such as an attached
HTML or binary file that reproduces the bug when loaded in Chrome. PLEASE
make the file as small as possible and remove any content not required to
demonstrate the bug.

On a public computer, I could sign into Chrome using a throwaway Gmail account. 

I could then visit passwords.google.com, enter my Google Account Password, and view all saved usernames & passwords from that computer. Note: this would NOT require me to re-enter their account password (as is the case when visiting passwords.google.com for your own account). 

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: [tab, browser, etc.]
Crash State: [see link above: stack trace *with symbols*, registers,
exception record]
Client ID (if relevant): [see link above]

 

Deleted: Screenshot (2).png 137 KB

	Screenshot (2).png 137 KB View Download