How Browser Autofill Can Leak Your Personal Data to Hackers

Autofill saves time by filling in your name, address, email, passwords and card details. But a form can ask for more than it shows. Researchers have found several ways pages can trick autofill into handing over information you never meant to give.

Hidden fields

In 2017, a Finnish developer, Viljami Kuosmanen, showed that a form displaying only name and email fields could include hidden fields for phone, address and more. When a browser autofilled the visible fields, it could fill the hidden ones too, and the page received them all. Browsers have since tightened how autofill works, but the case shows why it's worth checking what you're filling.

Scripts harvesting login autofill

Also in 2017, Princeton researchers found tracking scripts on some websites that inserted invisible login forms. Browser password managers filled in the saved email address, and the scripts collected it to identify visitors across sites.

Invisible page elements

In 2025, security research showed that several password manager extensions could be tricked by invisible page elements into filling personal or card details when a user clicked something that looked harmless. Many vendors released fixes, which is one more reason to keep extensions updated.

How to protect yourself

1. Fill only when you choose: use password managers that fill on a click or shortcut, rather than automatically on page load.
2. Check the address before filling anything. Password managers won't offer a login on the wrong site, which is a useful warning. See spotting fake websites.
3. Review saved data: in Chrome, open Settings → Autofill and passwords, and delete addresses, phone numbers and cards you don't need saved.
4. Don't save card security codes, and consider not saving cards at all on shared computers.
5. Turn off address autofill if you rarely use it.
6. Keep your browser and password manager updated.

Copy and paste has risks too

If you copy details instead of autofilling, they sit on your clipboard, where some pages can read them. Clipboard Guard blocks websites from reading your clipboard.

For site owners

Label fields clearly and use the standard autocomplete attributes, so browsers fill the right data in the right fields and users can see what's being asked. See autofill and accessible forms and more on autofill risks.