Not at all. You're explicitly performing an action with your password manager on a domain you've already decided to trust. Go head and inspect the source for t

Not at all. You're explicitly performing an action with your password manager on a domain you've already decided to trust. Go head and inspect the source for the Google account screen where you put in your email and you'll see a password field a few elements down with the name "hiddenPassword" with "display: none" set on it. This is a well known approach.