How third-party scripts on websites exploit a flaw in browsers' built-in password managers to identify and track users
In this second installment of the No Boundaries series, we show how a long-known vulnerability in browsers' built-in password managers is abused by third-party scripts for tracking on more than a thousand sites.
Context & Ripple Effects
This is not a new bug but a newly weaponized one: a year earlier, researchers showed that [[a:915656|hidden text boxes could trick Chrome, Safari, Opera and extensions like LastPass into leaking private information]], and the Freedom to Tinker piece documents that same password-manager autofill flaw now running at scale in third-party tracking scripts on more than a thousand sites.
It slots into a recurring pattern in the coverage — browser features designed for user convenience quietly doubling as tracking channels, from the favicon cache that survives incognito mode and script blockers to the autofill leak here. Each installment shows the same structure: a trusted browser component exposing state to any script a page loads.
First-order effects
- Visitors to the 1,000+ affected sites can be identified and tracked across visits even by users who never log in, because the scripts probe the browser's autofill rather than any account system.
- Browser vendors and password-manager maintainers — the Chrome, Safari, Opera and LastPass teams named in the prior hidden-text-box research — face pressure to change how autofill interacts with invisible form fields.
Second-order effects
- As cookie blocking and script blockers spread, ad-tech operators have a demonstrated incentive to migrate toward side channels that read browser-internal state, making password managers and caches the new tracking surface.
- Site operators embedding third-party scripts inherit a privacy liability they did not code themselves, tightening the audit burden on every tag, analytics snippet, and ad loader they include.
Third-order effects
- If convenience features keep leaking state to page scripts, browsers will have to redraw their trust boundary — treating third-party scripts as untrusted principals with no access to autofill, cache, or profile state — a shift the later finding that 245 extensions override security protections to scrape sites shows is still unfinished.
- The pattern points toward regulation and platform policy catching up to script-level tracking, since no single vendor patch can close a channel that reopens wherever a trusted feature is readable from page context.
The trend: Browser convenience features are being systematically converted into tracking channels, forcing browser makers to harden the boundary between trusted browser state and untrusted page scripts.