VULNERABILITY DETAILS
Applicable to logging in to personal banking. Successfully fooled a colleague, demonstrating his credentials were deleted, after which I could refresh the page and retrieve his credentials. This bug is almost too straightforward to reproduce, implying this behavior may be by design (?). Yet this is also hard to conceive, given I do not understand how a) the credentials are still maintained in memory somehow even though I remove it and Chrome confirms it is removed and b) why Chrome automatically re-adds it to the Passwords list without asking for approval to store the credentials.

VERSION
Chrome Version: Version 67.0.3396.62 (Official Build) (64-bit)
Operating System: Windows 10, winver 1709
Extensions: ABP only
No additional passwords managers are used on this system.
Only 1 instance of Chrome is open with 2 tabs
I have not created any custom client code or a spoof version of the banking website.
Tested in a regular Chrome instance (not incognito)

REPRODUCTION CASE
I will demonstrate the bug by means of a video at the following Google Photos URL: https://photos.app.goo.gl/mzjLkOqDtfClE1ht2 . Please note this video is only shared in this submission form, and not shared anywhere else at the moment. Also because of the rules of the vulnerability reward program.

1. In the video, I will thereby start with the scenario I presented to a co-worker, who's credentials I had just presumably 'removed'.
2. I press the key at the addressbar end, showing no passwords are saved.
3. I demonstrate that the password is not in the Manage Passwords list
4. I then refresh the page, or I re-enter the URL in the addressbar
5. The credentials are auto-filled, even though steps 2 and 3 demonstrated they did not exist.
6. I can log into the banking account
7. The credentials are automatically added back into the the Manage Passwords list, without any popup or user-confirmation to allow storing these credentials again.

SCENARIOS IN WHICH IT DOES NOT OCCUR
If you close the tab and open a new tab to navigate to the website, it does not occur. However, this has to be done before Chrome has 'the chance' to auto-fill the username and password fields into the existing, unclosed tab. Because as soon as it can, I will add the credentials back into the Manage Passwords.

Happy to hear from you,
Brouns