Google Chrome to allow users to add notes to saved passwords

Google is testing a new Chrome feature that allows users to add notes on passwords saved in the web browser.

The new feature was spotted by a Reddit user (u/Leopeva64-2) on Google Chrome Canary (version 101), which is an experimental future version three releases away from the stable branch, currently at version 98.

This feature will allow users to edit an existing saved password to add additional information, such as email addresses associated with the account, security questions/answers, or other information that may be required when logging in or using the site.

Google is currently testing this feature with a subset of users as it is not appearing in all browsers tested by BleepingComputer.

Convenience over security?

There are many valid reasons to use this feature, but at this point, it’s unclear how well-protected these notes will be.

Information-stealing malware like RedLine already can steal Chrome’s password databases, so if the notes are bundled with them, they will be vulnerable too.

For those who enter risky information directly associated with the password, the new feature will potentially increase the risk of having their accounts compromised.

Even if an infostealer grabs the list of passwords stored in Chrome, it will not help them bypass multi-factor authentication that users may have configured on their account.

However, if a user saves MFA backup codes or other sensitive information in the notes field, it could allow a threat actor increased access to accounts.

If you absolutely need to store notes on your browser, most password managers offer this option in conjunction with strong encryption and secret vault protection, so this may be a more secure way to do it.

If you’re interested in testing this feature on Chrome Canary, note that its roll-out is staged, so you may still not see it even on version 101.

We have reached out to Google to ask for more details on the new feature, its release date, and the security layer that will protect it, and we will update this post as soon as we hear back.