Google and Microsoft can access user data via extended spellcheck features

Google and Microsoft can access user data via extended spellcheck features available in Google Chrome and Microsoft Edge web browsers.

Although basic spellcheckers are enabled, features that present this potential privacy risk include Chrome’s Enhanced Spellcheck or Microsoft Editor when manually enabled.

The problem was discovered by Josh Summitt, co-founder and CTO of the JavaScript security firm otto-js, after testing his company’s script behaviors detection.

According to Summitt, in cases where Chrome Enhanced Spellcheck or Edge’s Microsoft Editor (spellchecker) were enabled, “basically anything” entered into form fields of those browsers was transferred to Google and Microsoft.

Form information submitted to Google and Microsoft when using major web browsers such as Chrome and Edge include PII, address, email, date of birth, contact information, bank and payment information and others.

It remains unclear what happens to user data once it reaches third-party providers such as Google’s server. Users can, however review if enhanced spellcheck is enabled in their browser by copying and pasting the link “Chrome://settings/?search=Enhanced+Spell+Check” into their address bar.

Otto-js also gave tips on how users can protect themselves against this.

“Companies can mitigate the risk of sharing their customers’ PII – by adding ‘spellcheck=false’ to all input fields, though this could create problems for users. Alternatively, you could add it to just the form fields with sensitive data. Companies can also remove the ability to ‘show password’.’ That won’t prevent spell-jacking, but it will prevent user passwords from being sent,”otto-js explains.

The sources for this piece include an article in BleepingComputer.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web