Skip to main content

Spellcheckers in Google Chrome could expose your passwords

If you like to be thorough and use an advanced spellchecker, we have some bad news — your personal information could be in danger.

Using the extended spellcheck in Google Chrome and Microsoft Edge transmits everything you input in order for it to be checked. Unfortunately, this includes information that should be strictly encrypted, such as passwords.

Chrome & Edge Enhanced Spellcheck Features Expose PII, Even Your Passwords

This issue, first reported by JavaScript security firm otto-js, was discovered accidentally while the company was testing its script behaviors detection. Josh Summitt, co-founder and CTO of otto-js, explains that pretty much everything you enter in form fields with advanced spellchecker enabled is later transmitted to Google and Microsoft.

“If you click on ‘show password,’ the enhanced spellcheck even sends your password, essentially spell-jacking your data,” said otto-js in its report. “Some of the largest websites in the world have exposure to sending Google and Microsoft sensitive user PII [personally identifiable information], including username, email, and passwords, when users are logging in or filling out forms. An even more significant concern for companies is the exposure this presents to the company’s enterprise credentials to internal assets like databases and cloud infrastructure.”

Many people use “show password” in order to make sure they haven’t made a typo, so potentially, a lot of passwords could be at risk here. Bleeping Computer tested this further and found that entering your username and password on CNN and Facebook sent the data to Google, while, Bank of America, and Verizon only sent the usernames.

Both Microsoft Edge and Google Chrome come with built-in spellcheckers that are pretty basic. These tools don’t require any further verification — what you input stays within your browser. However, if you’re using Chrome’s Enhanced Spellcheck or Microsoft’s Editor Spelling & Grammar Checker, everything you type in the browser is then sent to Google and Microsoft respectively.

That, in itself, is not unexpected. When you enable the enhanced spellchecker in Chrome, the browser tells you that the “text that you type in the browser is sent to Google.” However, many people would expect that this excludes PII that is often submitted in forms.

The severity of this depends on the websites you visit. Some form data may include Social Security numbers and Social Insurance numbers, your full name, address, and payment information. Login credentials also fall under this category.

It’s understandable that your inputs are sent outside of the browser in order to utilize the improved spellchecker, but it’s hard not to question how secure this is when personal data also receives that same treatment.

How to stay safe

A dark mystery hand typing on a laptop computer at night.
Andrew Brookes / Getty Images

If you’d rather not have your personal data transmitted to Microsoft and Google, you should stop using the advanced spellchecker for the time being. This means disabling the feature in your Chrome settings. Simply copy and paste this into your browser’s address bar: chrome://settings/?search=Enhanced+Spell+Check.

For Microsoft Edge, the advanced spellchecker comes in the form of a browser add-on, so simply right-click the icon of that extension in your browser and then tap on Remove from Microsoft Edge.

Google has ensured that it doesn’t attach any user identity to the data it processes for the spellchecker. However, it will work on excluding passwords from this entirely. Microsoft said it will investigate the problem, but didn’t follow up with Bleeping Computer beyond that just yet. Microsoft currently has another problem with Edge: hackers are using it to run a malvertising campaign.

Editors' Recommendations

Monica J. White
Monica is a UK-based freelance writer and self-proclaimed geek. A firm believer in the "PC building is just like expensive…
Google Chrome is getting a complete overhaul for its birthday
Screenshot of Google Chrome with updated Material You design language.

To mark the 15th anniversary of its popular web browser, Google is releasing a brand new update for Chrome. The biggest change will be a redesign for the browser that will now adhere to Google’s Material You design language. There is also an update for the Chrome Web Store, alongside enhanced search features and some tweaks to Safe Browsing.

Material You is Google's unified design language, which was first introduced with Android 12. According to a blog post shared by Chrome Vice President Parisa Tabriz, Chrome will be the latest product from the company that will be getting a design overhaul featuring new icons that place a strong emphasis on legibility. On top of that, there will be fresh color palettes that will expand to the tabs and toolbar.

Read more
Google’s answer to Microsoft Copilot is finally here
Generative AI in Google Search.

Google is adding to its AI repertoire with a new plug-in that will serve corporate teams for the not-so-low price of $30 per month. It's called Google Duet, and it allows you to translate your documents into various different Google apps with a click.

The Google Duet assistant is now available after being showcased at the Google I/O developer conference in May. The assistant is compatible with Google's Workspace apps, including Gmail, Drive, Slides, Docs, and others.

Read more
Windows 11 will finally respect your default browser — in Europe
Microsoft Edge appears on a computer screen with plants and a window in the background.

Microsoft makes it easy to change the default browser in Windows 11. That's important if you require special features specific to one of the many web browsers that are available on a PC. Unfortunately, it's not as simple to be rid of Edge entirely.

Microsoft Edge will still load to open some other file types. When opening a link from Windows Settings or other system components, the webpage will load in Edge. That's now about to change, however, according to a recent Windows blog post.

Read more