Password Autocomplete in Browser

OWASP 2013-A5 OWASP 2017-A6 OWASP 2021-A5 OWASP PC-C1 CAPEC-464 CWE-16 ISO27001-A.14.1.2 WASC-15

Almost all browsers have the functionality that allows user to save username, password and other credentials that are entered into HTML forms. These credentials are saved in the local computer or in a cloud account provided by the browser. When a new credentials are entered in a form, the browser prompts if credentials should be saved. Thereafter when the same form is displayed, the name and password are filled in automatically or are completed as the name is entered. An attacker with local access could obtain the cleartext password from the browser cache.


The following is the example of this vulnerability:-

        <INPUT TYPE="password" AUTOCOMPLETE="on">



The impact include:-

  • Attacker getting access to user credentials.
  • Possible loss of sensitive information.
  • Manipulation of sensitive information.

Mitigation / Precaution

This vulnerability can be fixed by:-

  • Disabling the password auto complete
        <INPUT TYPE="password" AUTOCOMPLETE="off">


Latest Articles