4 ms·
Nice find - you've noticed important threat. However on my Chrome (despite having autofill swithced on) your demo doesn't work.
by ArekDymalski 15y ago
Nice find - you've noticed important threat. However on my Chrome (despite having autofill swithced on) your demo doesn't work.
- ydant 15y agoIt, sadly, does on my install of Chrome (18.0.1025.113 beta) - Linux 32 bit.
- wglb 15y agoYou probably want to upgrade to the .151 version, which fixes other vulnerabilities as well.
- ianterrell 15y agoI'm on that version (18.0.1025.151) on OS X 10.7.3 and the vulnerability was present for me.
- wglb 15y agoAnd after I wrote the above comment, I tested it and I am as well, on Linux. The fun thing about this type of vulnerability is if you know the user's name, you can build an invisible form component to get the browser to spill the stored password.
- ladino 15y agois autofill enabled? - i even tested it on Chrome 19 and the bug is still there!
- Kadrith 15y agoI have autofill enabled with Chrome 19.0.1081.0 on Windows 7 and it did not fill the hidden fields. I have an update pending for Chrome, maybe it will reintroduce the issue.