Skip to main content

Spellcheckers in Google Chrome could expose your passwords

If you like to be thorough and use an advanced spellchecker, we have some bad news — your personal information could be in danger.

Using the extended spellcheck in Google Chrome and Microsoft Edge transmits everything you input in order for it to be checked. Unfortunately, this includes information that should be strictly encrypted, such as passwords.

Related Videos
Chrome & Edge Enhanced Spellcheck Features Expose PII, Even Your Passwords

This issue, first reported by JavaScript security firm otto-js, was discovered accidentally while the company was testing its script behaviors detection. Josh Summitt, co-founder and CTO of otto-js, explains that pretty much everything you enter in form fields with advanced spellchecker enabled is later transmitted to Google and Microsoft.

“If you click on ‘show password,’ the enhanced spellcheck even sends your password, essentially spell-jacking your data,” said otto-js in its report. “Some of the largest websites in the world have exposure to sending Google and Microsoft sensitive user PII [personally identifiable information], including username, email, and passwords, when users are logging in or filling out forms. An even more significant concern for companies is the exposure this presents to the company’s enterprise credentials to internal assets like databases and cloud infrastructure.”

Many people use “show password” in order to make sure they haven’t made a typo, so potentially, a lot of passwords could be at risk here. Bleeping Computer tested this further and found that entering your username and password on CNN and Facebook sent the data to Google, while SSA.gov, Bank of America, and Verizon only sent the usernames.

Both Microsoft Edge and Google Chrome come with built-in spellcheckers that are pretty basic. These tools don’t require any further verification — what you input stays within your browser. However, if you’re using Chrome’s Enhanced Spellcheck or Microsoft’s Editor Spelling & Grammar Checker, everything you type in the browser is then sent to Google and Microsoft respectively.

That, in itself, is not unexpected. When you enable the enhanced spellchecker in Chrome, the browser tells you that the “text that you type in the browser is sent to Google.” However, many people would expect that this excludes PII that is often submitted in forms.

The severity of this depends on the websites you visit. Some form data may include Social Security numbers and Social Insurance numbers, your full name, address, and payment information. Login credentials also fall under this category.

It’s understandable that your inputs are sent outside of the browser in order to utilize the improved spellchecker, but it’s hard not to question how secure this is when personal data also receives that same treatment.

How to stay safe

A dark mystery hand typing on a laptop computer at night.
Andrew Brookes/Getty Images

If you’d rather not have your personal data transmitted to Microsoft and Google, you should stop using the advanced spellchecker for the time being. This means disabling the feature in your Chrome settings. Simply copy and paste this into your browser’s address bar: chrome://settings/?search=Enhanced+Spell+Check.

For Microsoft Edge, the advanced spellchecker comes in the form of a browser add-on, so simply right-click the icon of that extension in your browser and then tap on Remove from Microsoft Edge.

Google has ensured that it doesn’t attach any user identity to the data it processes for the spellchecker. However, it will work on excluding passwords from this entirely. Microsoft said it will investigate the problem, but didn’t follow up with Bleeping Computer beyond that just yet. Microsoft currently has another problem with Edge: hackers are using it to run a malvertising campaign.

Editors' Recommendations

Don’t roll your eyes — AI isn’t just another doomed tech fad
chatgpt says it shouldnt write articles open ai chat bot seen on smartphone placed

Stop me if you've heard this one before: "This new technology will change everything!"

It's a phrase regurgitated endlessly by analysts and tech executives with the current buzzword of the moment plugged in. And in 2023, that buzzword is AI. ChatGPT has taken the world by storm, Microsoft redesigned its Edge browser around an AI chatbot, and Google is rushing to integrate its AI model deeply into search.

Read more
Microsoft is bringing ChatGPT to your browser, and you can test it out right now
Microsoft's redesigned Bing search engine.

Microsoft CEO Satya Nadella confirmed in a private briefing with the press that a ChatGPT-powered version of the Edge browser and Bing search engine is available now. The overhauled search and web browsing experience is designed for natural-language questions, replacing critical aspects of the browser with AI tools.

That might sound familiar. Google and other search engines have been leveraging AI for several years to compile search results, but Microsoft's take is different. It's "your AI copilot for the web," offering up new search, answer, chat, and create functions.

Read more
Google’s new Bard AI may be powerful enough to make ChatGPT worry — and it’s already here
A man walks past the logo of the US multinational technology company Google during the VivaTech trade fair.

OpenAI's ChatGPT has taken the world by storm, but it will soon have a formidable rival. Google has just announced that its new "experimental conversational AI service" called Bard has now entered the testing phase.

For Google, perfecting this AI model seems to be an absolute priority, and it's running out of time to do so. Luckily for Bard, it will have a certain edge over this version of ChatGPT.

Read more