Leaky Autofill: An Empirical Study on the Privacy Threat of Password Managers’ Autofill Functionality

Password managers (PMs) provide users with convenient and robust functionalities to manage their credentials, highly recommended by security experts and major standard bodies. One of the most popular features is the autofill functionality, with which users need a single click or a few clicks to fill in every field in web forms, facilitating the process of completing web forms. However, such indiscriminate autofill brings severe privacy threats. PMs may inadvertently fill data into wrong fields in web forms, even hidden fields, potentially leading to privacy leaks and credential theft.In this paper, we conduct an empirical study evaluating the effectiveness of 30 popular PMs in identifying and handling hidden fields. We focus on the privacy threats posed by the autofill functionality, which fills data into hidden fields. We develop a semi-automated autofill testing tool and explore whether PMs autofill sensitive data into hidden fields across 15 concealment techniques and three web forms, including personal information, credit card, and login forms. Experimental results reveal that every PM autofills data into hidden fields in at least one web form, with an overall filled probability of 58.7% in 1032 scenarios. Further analysis reveals that login forms are the most vulnerable, with a 65.7% probability of hidden fields autofill. Hidden fields concealed by clip-path and content-visibility are filled with passwords by all PMs. Besides, built-in-browser PMs exhibit a 4.07 times higher likelihood of filling data into hidden fields than separately-installed PMs. Even more concerning, built-in-browser PMs, except Safari, autofill passwords into hidden fields under any concealment technique. 37.7% of autofill scenarios with insufficient user interaction pose heightened privacy threats, as users are unaware of autofill content. These privacy threats have been confirmed by popular PMs like LastPass.To mitigate the threats brought by the autofill functionality, we present two actionable recommendations for PM operators/developers: (1) providing fine-grained data types in rendered overlays before autofilling; (2) integrating visual language model techniques to accurately identify fillable fields and prevent data autofilling into hidden fields. We believe this work makes a substantial step toward understanding the security implications of the autofill functionality in PMs.