> The nuance here is that brain-damaged appsec pentesters reported this as a vulnerability for years as a low-risk privacy defect yes, because things like bank

> The nuance here is that brain-damaged appsec pentesters reported this as a vulnerability for years as a low-risk privacy defect yes, because things like bank account and routing numbers would be stored in autofills for certain banking sites that don't require authn/authz to initiate a transfer. (I can think of a handful of platforms frequently used for common services like paying HOA fees which are currently vulnerable to this, meaning another user sharing the machine can simply hit ⬇ on the keyboard in form fields on a page that doesn't require authn/authz to initiate an external transfer in order to capture any stored banking details that were previously entered into the form.) Source: I was one of those brain-damaged appsec pentesters.