Spell-jacking on Chrome and Edge browsers

Looks like spell checking on Chrome and Edge will send form data from passwords as well as PII ( personal identifiable information ) to Google and Microsoft. Chrome's Enhanced Spellcheck or Microsoft Editor, when manually enabled by the user, exhibits this potential privacy risk. Check your settings folks.

https://www.bleepingcomputer.com/news/security/google-microsoft-can-get-your-passwords-via-web-browsers-spellcheck/

SA

SoulAsylum:

Looks like spell checking on Chrome and Edge will send form data from passwords as well as PII ( personal identifiable information ) to Google and Microsoft. Chrome's Enhanced Spellcheck or Microsoft Editor, when manually enabled by the user, exhibits this potential privacy risk...

Hi SoulAsylum:

Thanks for posting about this.

That 17-Sep-2022 BleepingComputer article Google, Microsoft Can Get Your Passwords Via Web Browser's Spellcheck says "Both Chrome and Edge ship with basic spellcheckers enabled. But, features like Chrome's Enhanced Spellcheck or Microsoft Editor when manually enabled by the user, exhibit this potential privacy risk...As for Edge, Microsoft Editor Spelling & Grammar Checker is a browser addon that needs to be explicitly installed for this behavior to take place." However, that information seems to be incorrect - at least for MS Edge.

The 03-Jun-2022 MakeUseOf article How to Use Microsoft Editor in Edge for Error-Free Writing notes that "Microsoft Editor is built straight into Edge, so doesn't require any additional software to get it started". I don't know when Microsoft Editor was originally built in to MS Edge (I searched the archived release notes <here> but couldn't find the exact version number) but the 06-Oct-2021 SlashGear article Microsoft Edge is Getting a Built-in Spelling and Grammar Check suggests it was quite a while ago.

Even worse, the Languages section of my MS Edge settings (edge://settings/languages) confirms that that Microsoft Editor is not only built in to my current MS Edge 105.0.1343.42 browser, but that the default setting is to use the problematic Microsoft Editor instead of basic spell checking. Firefox is my default browser but as a precaution I've now changed my MS Edge writing assistance setting back to Basic spell checking.

---------
Dell Inspiron 5584 * 64-bit Win 10 Pro v21H2 build 19044.2006 * Firefox v104.0.2 * MS Edge v105.0.1343.42 * Microsoft Defender v4.18.2207.7-1.1.19600.3 * Malwarebytes Premium v4.5.14.210-1.0.1767 * Macrium Reflect Free v8.0.6979