Google Inc. regarding the upcoming release of Chrome 86, which will include protection against unsafe submission of web forms. The protection concerns forms displayed on pages loaded over HTTPS but sending data unencrypted over HTTP, posing a risk of data interception and tampering during MITM attacks. Three changes have been implemented for such mixed web forms:
- Auto-completion of any mixed input forms has been disabled, similar to how auto-completion has long been disabled for authentication forms on pages opened over HTTP. Previously, the indication for disabling auto-completion was the opening of the page with the form over HTTPS or HTTP; now, the use of encryption during data submission to the form handler will also be taken into account. Password manager functionality, which allows the use of secure and unique passwords, will not be disabled for mixed authentication forms, as the risk of using an unreliable password and reusing passwords across different sites outweighs the risk of potential traffic interception.
- When beginning to input data in mixed forms, a warning will be displayed to inform the user that the filled data will be sent through an unencrypted communication channel.
- When attempting to submit a mixed form, a separate page will be shown with a notification about the potential risk of transmitting data over an unencrypted communication channel. In previous versions, a lock indicator in the address bar was used to indicate mixed forms, but this sign was not obvious to users and did not effectively reflect the emerging risks.
Source: opennet.ru
