From 95c5b41a8b34809a84a3836fef737ea05f10bef3 Mon Sep 17 00:00:00 2001
From: Avi Drissman <avi@chromium.org>
Date: Tue, 09 Jun 2026 00:29:42 -0700
Subject: [PATCH] Make revealed password fields behave as password fields

For the purposes of autofill, any text field that was once a password
field should be treated as a password field.

Fixed: 519719512
Change-Id: Id64f8416a0b211e55ac8dea25f0f74c86a6a6964
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7901496
Reviewed-by: Dominic Battré <battre@chromium.org>
Commit-Queue: Dominic Battré <battre@chromium.org>
Reviewed-by: Mason Freed <masonf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1643745}
---

diff --git a/third_party/blink/renderer/core/page/context_menu_controller.cc b/third_party/blink/renderer/core/page/context_menu_controller.cc
index 41e66cb4..63b07894 100644
--- a/third_party/blink/renderer/core/page/context_menu_controller.cc
+++ b/third_party/blink/renderer/core/page/context_menu_controller.cc
@@ -116,6 +116,14 @@
     } else {
       data.form_renderer_id = 0;
     }
+    // If a field has been a password field then it should be treated as a
+    // password field for the purposes of autofill. (If needed in the future,
+    // this state could be added to ContextMenuData as a separate boolean, but
+    // for now this will do.)
+    if (auto* input_element = DynamicTo<HTMLInputElement>(node);
+        input_element && input_element->HasBeenPasswordField()) {
+      data.form_control_type = mojom::blink::FormControlType::kInputPassword;
+    }
   }
   if (auto* html_element =
           node ? DynamicTo<HTMLElement>(RootEditableElement(*node)) : nullptr) {
diff --git a/third_party/blink/renderer/core/page/context_menu_controller_test.cc b/third_party/blink/renderer/core/page/context_menu_controller_test.cc
index a7edfc24..555d5dc 100644
--- a/third_party/blink/renderer/core/page/context_menu_controller_test.cc
+++ b/third_party/blink/renderer/core/page/context_menu_controller_test.cc
@@ -2516,4 +2516,23 @@
   EXPECT_EQ(context_menu_data.src_url.spec(), "https://example.com/image.png");
 }
 
+TEST_F(ContextMenuControllerTest, RevealedPasswordField) {
+  Document* document = GetDocument();
+  document->documentElement()->SetInnerHTMLWithoutTrustedTypes(
+      "<input type=text id=test>");
+  document->UpdateStyleAndLayout(DocumentUpdateReason::kTest);
+  document->GetFrame()->Selection().SelectAll();
+
+  Element* element = document->getElementById(AtomicString("test"));
+  HTMLInputElement* input_element = To<HTMLInputElement>(element);
+  ASSERT_TRUE(input_element);
+  input_element->MaybeSetHasBeenPasswordField();
+
+  ASSERT_TRUE(ShowContextMenuForElement(
+      element, ui::mojom::blink::MenuSourceType::kMouse));
+  ContextMenuData context_menu_data = GetWebFrameClient().GetContextMenuData();
+  EXPECT_EQ(context_menu_data.form_control_type,
+            mojom::blink::FormControlType::kInputPassword);
+}
+
 }  // namespace blink

diff --git a/third_party/blink/renderer/core/page/context_menu_controller_test.cc b/third_party/blink/renderer/core/page/context_menu_controller_test.cc
index a7edfc24..555d5dc 100644
--- a/third_party/blink/renderer/core/page/context_menu_controller_test.cc
+++ b/third_party/blink/renderer/core/page/context_menu_controller_test.cc
@@ -2516,4 +2516,23 @@
   EXPECT_EQ(context_menu_data.src_url.spec(), "https://example.com/image.png");
 }
 
+TEST_F(ContextMenuControllerTest, RevealedPasswordField) {
+  Document* document = GetDocument();
+  document->documentElement()->SetInnerHTMLWithoutTrustedTypes(
+      "<input type=text id=test>");
+  document->UpdateStyleAndLayout(DocumentUpdateReason::kTest);
+  document->GetFrame()->Selection().SelectAll();
+
+  Element* element = document->getElementById(AtomicString("test"));
+  HTMLInputElement* input_element = To<HTMLInputElement>(element);
+  ASSERT_TRUE(input_element);
+  input_element->MaybeSetHasBeenPasswordField();
+
+  ASSERT_TRUE(ShowContextMenuForElement(
+      element, ui::mojom::blink::MenuSourceType::kMouse));
+  ContextMenuData context_menu_data = GetWebFrameClient().GetContextMenuData();
+  EXPECT_EQ(context_menu_data.form_control_type,
+            mojom::blink::FormControlType::kInputPassword);
+}
+
 }  // namespace blink