I accidentally said that I leaked my mouth! Autofill feature is exploding with major security risks

Whenever you sign up for a new website or fill in the shipping address, you can get a headache when you look at a bunch of text input boxes. At this point, I believe that most people will use the auto-fill function that comes with the browser. One-click filling of information such as name, phone number, address, etc. can save a lot of time.

However, just recently, a Finnish web developer and hacker Viljami Kuosmanen discovered a major potential security hole, pointing out browsers with auto-filling features like Chrome, Safari and Opera, as well as plug-ins and tools that provide the same functionality ( Such as LastPass) will reveal the privacy of the user.

By simple means, the hacker can selectively hide the text input box on the page, which means that the browser will automatically fill in the hidden input box without your knowledge. As shown in the following picture of Viljami, although the test page only requires input of name and email address, after pressing the submit button, the capture information is displayed. In addition to these two messages, the user's phone number, address and other information are also uploaded.

Although personal information such as name, address, and phone number has been leaked since the rise of online shopping. However, for some Haitao people, it is often necessary to fill in sensitive information such as credit card number, expiration date and security code, which involves the security of personal funds. What is even more worrying is that, according to Viljami, this vulnerability has existed for many years.

Since one-click form fill is not supported, Firefox requires users to click on the input box one by one to give input suggestions, and they naturally can't click on the hidden input box. In addition to the option to use Firefox to avoid vulnerabilities, users can also choose to manually enter (check the source code of the web page as a method), or directly turn off the browser's auto-fill feature.

Turn off Chrome's auto-fill feature: Settings – click on “Show advanced settings” – remove the checkbox under “Passwords and forms”