2024 Training Schedule is now available!

Why You Should Disable Autofill on Your Browsers

Share This Post

Completing an online order.  Filling out another registration form.  These are just some of the online tasks we’re happy to have Autofill complete the information for us. Why should you disable Autofill on your browsers? Recently, web developer Viljami Kuosmanen discovered a vulnerability that can expose your stored data to a malicious person via phishing.  In this attack, a phishing email would be sent asking the target to complete a form on a web page.  Once the target fills out one of the (visible) fields, the browser then auto-populates multiple invisible fields on the page (drawing from the stored Autofill data).  

Why You Should Disable Autofill on Your Browsers 

 Above is an example of the hack in action, and you can also test it out yourself on a test page Kuosmanen setup. With this, it’s possible to give an attacker access to your address, credit card information, and other sensitive data.  According to Forbes password keeper, Last Pass is also susceptible to this vulnerability, which could cause you to give up your passwords unknowingly.  

Prevention against the attack

One of the most reliable is turning Autofill off on your browser.  It is easy to do, and if you’re using Chrome you can just follow these steps:screen-shot-2017-01-26-at-9-41-25-am

  • Open Chrome and click on the settings button in the upper right.   
  • At the bottom, click Show advanced settings. 
  • Under “Passwords and forms,” uncheck “Enable Autofill to fill out web forms in a single click.” 
  • Click on Manage Autofill Settings, and delete any data that has already been stored. 

If you’re looking to protect your enterprise environment from this, you’ll need to educate your users on not clicking and reporting suspicious emails.  Phishing emails use many varied tactics, and exposing employees to these will help them to prevent attacks.  Phishing as a Service (PHaaS) can offer continual testing and training to employees, helping them to spot phishing emails and know how to interact with them safely.  This is a proven measure where corporations have seen reduced click ratios, increased reporting, and significant drops in malware on their networks.

Remember, if an email is asking you to visit a website or submit information, you should always manually navigate to a known trusted website (like your bank) to log in and enter information.  Don’t ever click on suspicious email links or download attachments from unknown senders, and be wary if you continue to utilize the Autofill function on your browsers. 



More To Explore

Are You At Risk for SMiShing?

Are You at Risk for SMiShing?

Most of us have received a bogus text message that mentioned some sort of problem with a recent delivery or an issue with a PayPal or Amazon account. The instructions

Vishing Attacks Targeting Healthcare Organizations

Vishing Attacks Targeting Healthcare Organizations 

The Health Sector Cybersecurity Coordination Center (HC3) sent an alert in August 2022 detailing an increase in vishing attacks targeting healthcare organizations. Health systems were warned to watch for attacks