I can reproduce this (passwords saved on http but filled on https), but this doesn't seem to work the other way around, which is the more interesting case (password saved on https but filled on http).

+vabr to comment on if this is expected behaviour.

This is working as intended, it is a feature. The bug tracking adding that feature was  issue 571580 .

So, my question is, HTTP and HTTPS could be completely different Web sites (
although the possibility is small) . And even the same site, the server's 80 and 443 port could be protected with different security level, E.g firewall.

So, Could you please explain how much will this feature introduce securtiy risk? Thanks

Looking at https://chromium.googlesource.com/chromium/src/+/e265f2fc6651f9c657ee166778643e92923abbc9/components/password_manager/core/browser/http_password_store_migrator.cc#43, the migration should not work across ports, only the scheme might change.

The security discussion is part of the design doc, which I now made viewable by anyone https://docs.google.com/document/d/1ei3PcUNMdgmSKaWSb-A4KhowLXaBMFxDdt5hvU_0YY8/edit?usp=sharing.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot