A bug in Chrome Password Manager caused user credentials to disappear

Google addressed a Chrome’s Password Manager bug that caused user credentials to disappear temporarily for more than 18 hours.

Google has addressed a bug in Chrome’s Password Manager that caused user credentials to disappear temporarily.

An 18-hour outage impacted Google Chrome’s Password Manager on Wednesday, impacting users who rely on the tool to store and autofill their passwords.

Many users reported that their passwords were no longer available through their Google Password Manager, noticing that only usernames were available in the autofill function. The company pointed out that user data was not lost.

The problem impacted approximately 2% of all Windows users who had upgraded to Chrome version 127. The glitch only impacted those users who updated to Chrome version 127.0.6533.73.

“A significant number of users were unable to find or save passwords in the password manager for Chrome browser, for a period of 17 hours, 51 minutes. From the preliminary analysis the root cause of the issue is a change in product behavior without proper feature guard. Google engineers mitigated the issue by deploying a fix. Google will complete a full IR in the following days that will provide a full root cause.” read the statement published by the Google on the Workspace Status Dashboard. “Impacted users were unable to find passwords in Chrome’s password manager. Users can save passwords, however it was not visible to them. The impact was limited to the M127 version of Chrome Browser on the Windows platform.”

A Reddit user reported being presented with a ‘Save password?’ prompt on every login page, even for websites where they had previously declined. The user noted that their list of ‘declined’ websites had disappeared.

The IT giant addressed the bug in its browser’s Password Manager, then advised users to restart their Chrome browser to ensure the fix was applied. An interim workaround had been provided during the incident, but the company states that only the restart ensures the solution takes full effect.

The company recommends impacted users the following procedure:

Launch Chrome with ” –enable-features=SkipUndecryptablePasswords” command line flag.

1. Locate Chrome shortcut on desktop. If you don’t have it, go to chrome://settings/manageProfile and at the bottom enable “Create desktop shortcut”.
2. Fully exit Chrome
3. Go to desktop and right click the shortcut then click Properties.
4. To the target field paste the following string to the end ” –enable-features=SkipUndecryptablePasswords”.
5. Close the dialog with OK and launch Chrome using this shortcut.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Password Manager)