Despite the changes introduced in crrev.com/c/771190, the CM API does not actually work in embedded contexts, because the above-mentioned CL only relaxed the restrictions on the renderer-side, not the browser-side, see:

https://cs.chromium.org/chromium/src/chrome/browser/password_manager/chrome_password_manager_client.cc?l=1013-1018&rcl=4ac1bca28661d78c10613a5f098bb2510426a474