Privacy Risks of Browser Autofill: What Hackers Can Steal

Autofill saves time by filling in your name, address, passwords and card details. The same convenience creates risks: pages that collect more than you meant to give, malware that steals saved browser data, and anyone else using your computer.

Risk 1: forms that take more than you see

Researchers have shown that a page can include extra fields, hidden or off-screen, so that autofilling your name also fills in your address or phone number. Browsers have added protections, but the safest habit is to check what autofill offers to fill, and to autofill only on sites you trust.

Risk 2: malware that steals browser data

"Infostealer" malware, often installed through fake downloads or pirated software, copies saved passwords, cookies, autofill data and browsing history from browsers, then sends them to criminals. Stolen session cookies can even let them into accounts without your password.

• Chrome on Windows encrypts cookies in a way that's tied to Chrome, which makes theft harder, but not impossible.
• The real defense is not getting infected. See how to download files safely.

Risk 3: people with access to your computer

Anyone who sits down at your computer while you're away can see your saved addresses, open accounts that stay signed in, and search your history. Lock your screen when you step away, and use a separate profile or guest mode for others.

What's safe and what's not

• Passwords: a password manager, including Chrome's, is safer than reusing passwords, and it only fills on the real site's address, which protects you from look-alike phishing sites.
• Payment cards: if you save cards, turn on verification so Chrome asks for your device's screen lock or the card's security code before filling.
• Addresses: lower risk, but turn them off on shared computers.
• Banking details: type them yourself; don't save them in forms.

Settings to check

• chrome://settings/autofill: review saved passwords, payment methods and addresses, and delete what you don't need.
• Turn on Enhanced protection under Privacy and security → Security.
• Use two-step verification on important accounts, so a stolen password isn't enough.

Can hackers see your search history?

Not remotely, under normal conditions. Your history stays on your device and, if you use sync, in your Google account. It's exposed if malware is on your computer, if someone gets into your Google account, or if someone uses your device. Strong account security and malware protection cover all three.

For more ways to stay private, see how to secure your browser for banking. If you want the profile advertisers build from your browsing to be less accurate, Ghost Browser adds random background visits.