Advanced Spell Checker In Chrome And Edge Could Expose Your Passwords

If you want to use the extended spell check in the Chrome and Edge browsers, you should be careful what information is entered in web forms. Because these are then not only sent to the desired recipient. The security researchers at the security company Otto-js, which specializes in security issues relating to JavaScript, pointed out this problem.

Accordingly, the two browsers send virtually everything that is entered into the input areas of websites directly to the two browser manufacturers, where it is then evaluated by cloud-based spelling algorithms, reports the US magazine bleeding computer. A simple spell checker is used by default in both the Google browser and its Microsoft offshoot. This works completely locally and does not transmit any data to the Internet. It can therefore also be used safely if you want to exchange information about sensitive topics with a communication partner. Demonstration of insecure spell checking in the browser.

Beware Of Passwords

But the situation is different with the extended spell checks, which also include grammar rules. Here the analysis takes place in the data centers of the manufacturers. Accordingly, all information must be sent over the network in order to process it there. However, many users are not aware of this at all and assume that content in input fields is only sent to the actual recipient – especially if it is a website with an encrypted connection.

Accordingly, data such as names, addresses, telephone numbers, credit card numbers, or private e-mail content can end up with the browser providers. And if the user activates the password display option, the access code is also displayed in plain text. Therefore, users are better off deactivating the spelling functions in question if they use their browser to transmit information that they would prefer not to pass on to Google or Microsoft.