2025 Foundational Application of Social Engineering

Why You Should Disable Autofill on Your Browsers

Share This Post

Completing an online order.  Filling out another registration form.  These are just some of the online tasks we’re happy to have Autofill complete the information for us. Why should you disable Autofill on your browsers? Recently, web developer Viljami Kuosmanen discovered a vulnerability that can expose your stored data to a malicious person via phishing.  In this attack, a phishing email would be sent asking the target to complete a form on a web page.  Once the target fills out one of the (visible) fields, the browser then auto-populates multiple invisible fields on the page (drawing from the stored Autofill data).  

Why You Should Disable Autofill on Your Browsers 

 Above is an example of the hack in action, and you can also test it out yourself on a test page Kuosmanen setup. With this, it’s possible to give an attacker access to your address, credit card information, and other sensitive data.  According to Forbes password keeper, Last Pass is also susceptible to this vulnerability, which could cause you to give up your passwords unknowingly.  

Prevention against the attack

One of the most reliable is turning Autofill off on your browser.  It is easy to do, and if you’re using Chrome you can just follow these steps:screen-shot-2017-01-26-at-9-41-25-am

  • Open Chrome and click on the settings button in the upper right.   
  • At the bottom, click Show advanced settings. 
  • Under “Passwords and forms,” uncheck “Enable Autofill to fill out web forms in a single click.” 
  • Click on Manage Autofill Settings, and delete any data that has already been stored. 

If you’re looking to protect your enterprise environment from this, you’ll need to educate your users on not clicking and reporting suspicious emails.  Phishing emails use many varied tactics, and exposing employees to these will help them to prevent attacks.  Phishing as a Service (PHaaS) can offer continual testing and training to employees, helping them to spot phishing emails and know how to interact with them safely.  This is a proven measure where corporations have seen reduced click ratios, increased reporting, and significant drops in malware on their networks.

Remember, if an email is asking you to visit a website or submit information, you should always manually navigate to a known trusted website (like your bank) to log in and enter information.  Don’t ever click on suspicious email links or download attachments from unknown senders, and be wary if you continue to utilize the Autofill function on your browsers. 

Sources:
https://github.com/anttiviljami/browser-autofill-phishing

https://www.forbes.com/sites/leemathews/2017/01/10/this-simple-phishing-attack-tricks-you-into-leaking-browser-autofill-data/

More To Explore

The growing danger of callback phishing
Phishing

The Rising Threat of Callback Phishing

The cybersecurity landscape is constantly evolving, with new threats emerging at an alarming rate. As technology advances, so do the methods used by cybercriminals as they employ more complex and

The Rise of AI Enabled Social Engineering Attacks
Artificial Intelligence and Deep Fakes

The Rise of AI-Enabled Social Engineering Attacks

In 2025, artificial intelligence will be a key focus for cybersecurity analysts and professionals. AI-enabled social engineering attacks are ushering in a new era of cybersecurity threats. Using advanced machine