https://www.bleepingcomputer.com/news/security/google-microsoft-can-get-your-passwords-via-web-browsers-spellcheck/ BleepingComputer.com logo * * * [ ] [Login] [Sign up] * * * [ ] [Login] [Sign up] * News + Featured + Latest + Uber hacked, internal systems breached and vulnerability reports stolen Uber hacked, internal systems breached and vulnerability reports stolen + Microsoft Edge's News Feed ads abused for tech support scams Microsoft Edge's News Feed ads abused for tech support scams + Akamai stopped new record-breaking DDoS attack in Europe Akamai stopped new record-breaking DDoS attack in Europe + Hive ransomware claims cyberattack on Bell Canada subsidiary Hive ransomware claims cyberattack on Bell Canada subsidiary + Google, Microsoft can get your passwords via web browser's spellcheck Google, Microsoft can get your passwords via web browser's spellcheck + Emotet botnet now pushes Quantum and BlackCat ransomware Emotet botnet now pushes Quantum and BlackCat ransomware + New York ambulance service discloses data breach after ransomware attack New York ambulance service discloses data breach after ransomware attack + Get Microsoft Office and a course on how to use it for $80 Get Microsoft Office and a course on how to use it for $80 * Downloads + Latest + Most Downloaded + Qualys BrowserCheck Qualys BrowserCheck + STOPDecrypter STOPDecrypter + AuroraDecrypter AuroraDecrypter + FilesLockerDecrypter FilesLockerDecrypter + AdwCleaner AdwCleaner + ComboFix ComboFix + RKill RKill + Junkware Removal Tool Junkware Removal Tool * Virus Removal Guides + Latest + Most Viewed + Ransomware + Remove the Theonlinesearch.com Search Redirect Remove the Theonlinesearch.com Search Redirect + Remove the Smartwebfinder.com Search Redirect Remove the Smartwebfinder.com Search Redirect + How to remove the PBlock+ adware browser extension How to remove the PBlock+ adware browser extension + Remove the Toksearches.xyz Search Redirect Remove the Toksearches.xyz Search Redirect + Remove Security Tool and SecurityTool (Uninstall Guide) Remove Security Tool and SecurityTool (Uninstall Guide) + How to remove Antivirus 2009 (Uninstall Instructions) How to remove Antivirus 2009 (Uninstall Instructions) + How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo + How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller + Locky Ransomware Information, Help Guide, and FAQ Locky Ransomware Information, Help Guide, and FAQ + CryptoLocker Ransomware Information Guide and FAQ CryptoLocker Ransomware Information Guide and FAQ + CryptorBit and HowDecrypt Information Guide and FAQ CryptorBit and HowDecrypt Information Guide and FAQ + CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ * Tutorials + Latest + Popular + How to open a Windows 11 Command Prompt as Administrator How to open a Windows 11 Command Prompt as Administrator + How to make the Start menu full screen in Windows 10 How to make the Start menu full screen in Windows 10 + How to install the Microsoft Visual C++ 2015 Runtime How to install the Microsoft Visual C++ 2015 Runtime + How to open an elevated PowerShell Admin prompt in Windows 10 How to open an elevated PowerShell Admin prompt in Windows 10 + How to start Windows in Safe Mode How to start Windows in Safe Mode + How to remove a Trojan, Virus, Worm, or other Malware How to remove a Trojan, Virus, Worm, or other Malware + How to show hidden files in Windows 7 How to show hidden files in Windows 7 + How to see hidden files in Windows How to see hidden files in Windows * Deals + Categories + eLearning eLearning + IT Certification Courses IT Certification Courses + Gear & Gadgets Gear + Gadgets + Security Security * Forums * More + Startup Database + Uninstall Database + Glossary + Chat on Discord + Send us a Tip! + Welcome Guide * Home * News * Security * Google, Microsoft can get your passwords via web browser's spellcheck * * Google, Microsoft can get your passwords via web browser's spellcheck By Ax Sharma * September 17, 2022 * 02:39 PM * 0 password Extended spellcheck features in Google Chrome and Microsoft Edge web browsers transmit form data, including personally identifiable information (PII) and in some cases, passwords, to Google and Microsoft respectively. While this may be a known and intended feature of these web browsers, it does raise concerns about what happens to the data after transmission and how safe the practice might be, particularly when it comes to password fields. Both Chrome and Edge ship with basic spellcheckers enabled. But, features like Chrome's Enhanced Spellcheck or Microsoft Editor when manually enabled by the user, exhibit this potential privacy risk. Spell-jacking: That's your spellcheck sending PII to Big Tech When using major web browsers like Chrome and Edge, your form data is transmitted to Google and Microsoft, respectively, should enhanced spellcheck features be enabled. Depending on the website you visit, the form data may itself include PII--including but not limited to Social Security Numbers (SSNs)/ Social Insurance Numbers (SINs), name, address, email, date of birth (DOB), contact information, bank and payment information, and so on. Josh Summitt, co-founder & CTO of JavaScript security firm otto-js discovered this issue while testing his company's script behaviors detection. In cases where Chrome Enhanced Spellcheck or Edge's Microsoft Editor (spellchecker) were enabled, "basically anything" entered in form fields of these browsers was transmitted to Google and Microsoft. "Furthermore, if you click on 'show password,' the enhanced spellcheck even sends your password, essentially Spell-Jacking your data," explains otto-js in a blog post. "Some of the largest websites in the world have exposure to sending Google and Microsoft sensitive user PII, including username, email, and passwords, when users are logging in or filling out forms. An even more significant concern for companies is the exposure this presents to the company's enterprise credentials to internal assets like databases and cloud infrastructure." Alibaba login form fieldsAlibaba login form fields, with 'show password' enabled (otto-js) Enhanced spellchecker transmits password to Microsoft and Google Chrome's enhanced spellchecker transmits password to Google (otto-js) Users may often rely on the "show password" option on sites where copying-pasting passwords is not allowed, for example, or when they suspect they've mistyped it. To demonstrate, otto-js shared the example of a user entering credentials on Alibaba' Cloud platform in the Chrome web browser--although any website can be used for this demonstration. With enhanced spellcheck enabled, and assuming the user tapped "show password" feature, form fields including username and password are transmitted to Google at googleapis.com. A video demonstration has also been shared by the company: BleepingComputer also observed credentials being transmitted to Google in our tests using Chrome to visit major sites like: * CNN--both username and password when using 'show password' * Facebook.com--both username and password when using 'show password' * SSA.gov (Social Security Login)--username field only * Bank of America--username field only * Verizon--username field only A simple HTML solution: 'spellcheck=false' Although the transmission of form fields is happening securely over HTTPS, it may not be imminently clear as to what happens to user data once it reaches the third-party, in this example, Google's server. "The Enhanced spell check feature requires an opt-in from the user," a Google spokesperson confirmed to BleepingComputer. Note, that this is in contrast to the basic spellchecker that is enabled in Chrome by default and does not transmit data to Google. To review if Enhanced spell check is enabled in your Chrome browser, copy-paste the following link in your address bar. You can then choose to turn it on or off: chrome://settings/?search=Enhanced+Spell+Check chrome enhanced spellcheck settingEnhanced spell check setting in Chrome needs to be opted-in (BleepingComputer) As evident from the screenshot, the feature's description explicitly states that with Enhanced spell check enabled, "text that you type in the browser is sent to Google." "The text typed by the user may be sensitive personal information and Google does not attach it to any user identity and only processes it on the server temporarily. To further ensure user privacy, we will be working to exclude passwords proactively from spell check," continued Google in its statement shared with us. "We appreciate the collaboration with the security community, and we are always looking for ways to better protect user privacy and sensitive information." As for Edge, Microsoft Editor Spelling & Grammar Checker is a browser addon that needs to be explicitly installed for this behavior to take place. BleepingComputer reached out to Microsoft well in advance prior to publishing. We were told that the matter was being looked into but we are yet to hear back. otto-js dubbed the attack vector "Spell-jacking" and expressed concern for users of cloud services like Office 365, Alibaba Cloud, Google Cloud - Secret Manager, Amazon AWS - Secrets Manager, and LastPass. Reacting to otto-js' report, both AWS and LastPass mitigated the issue. In LastPass' case, the remedy was reached by adding a simple HTML attribute spellcheck="false" to the password field: lastpass password fieldLastPass "password" field now includes spellcheck=false HTML attribute (BleepingComputer) The 'spellcheck' HTML attribute when left out from form text input fields is usually assumed by web browsers be true by default. An input field with 'spellcheck' explicitly set to false will not be processed through a web browser's spellchecker. "Companies can mitigate the risk of sharing their customers' PII - by adding 'spellcheck=false' to all input fields, though this could create problems for users," explains otto-js referring to the fact, users will now no longer be able to run their entered text though spellchecker. "Alternatively, you could add it to just the form fields with sensitive data. Companies can also remove the ability to 'show password.' That won't prevent spell-jacking, but it will prevent user passwords from being sent." Ironically enough, we observed Twitter's login form, which comes with the "show password" option, has the password field's "spellcheck" HTML attribute explicitly set to true: twitter spellcheck fieldTwitter password field has 'show password' and spellcheck set to true (BleepingComputer) As an added safeguard, Chrome and Edge users can turn off Enhanced Spell Check (by following the aforementioned steps) or remove the Microsoft Editor add-on from Edge until both companies have revised extended spellcheckers to exclude processing of sensitive fields, like passwords. Related Articles: GitHub Arctic Vault likely contains leaked MedData patient records Chrome extensions with 1.4 million installs steal browsing data Protect your privacy with this Windscribe VPN Pro deal Apple released iOS 16 with Lockdown, Safety Check security features Over 80% of the top websites leak user searches to advertisers * Passwords * PII * Privacy * * * * * Ax Sharma Ax Sharma is a Security Researcher and Tech Reporter. His works and expert analyses have frequently been featured by leading media outlets including BBC, Business Insider, Fortune, TechCrunch, The Register, and others. Ax's expertise lies in vulnerability research, malware analysis, and open source software. He's an active community member of OWASP Foundation and the British Association of Journalists (BAJ). Send any tips via email or Twitter DM. * Previous Article Post a Comment Community Rules You need to login in order to post a comment [Login] Not a member yet? Register Now You may also like: [INS::INS] Popular Stories * Uber Uber hacked, internal systems breached and vulnerability reports stolen * Lastpass LastPass says hackers had internal access for four days Newsletter Sign Up To receive periodic updates and news from BleepingComputer, please use the form below. [ ] [Submit] Newsletter Sign Up [ ] [Submit] * Follow us: * * * * Main Sections * News * Downloads * Virus Removal Guides * Tutorials * Startup Database * Uninstall Database * Glossary Community * Forums * Forum Rules * Chat Useful Resources * Welcome Guide * Sitemap Company * About BleepingComputer * Contact Us * Send us a Tip! * Advertising * Write for BleepingComputer * Social & Feeds * Changelog Terms of Use - Privacy Policy - Ethics Statement Copyright @ 2003 - 2022 Bleeping Computer^(r) LLC - All Rights Reserved Login Username [ ] Password [ ] [*] Remember Me [ ] Sign in anonymously [Login] Sign in with Twitter button Sign in with Twitter --------------------------------------------------------------------- Not a member yet? Register Now Reporter Help us understand the problem. What is going on with this comment? * ( )Spam * ( )Abusive or Harmful * ( )Inappropriate content * ( )Strong language * ( )Other [ ] * [ ] Read our posting guidelinese to learn what content is prohibited. Submitting... SUBMIT