diff --git a/components/autofill/core/common/password_form_fill_data.cc b/components/autofill/core/common/password_form_fill_data.cc
index 2fcba043f9fe6..2da0a4b3c92aa 100644
--- a/components/autofill/core/common/password_form_fill_data.cc
+++ b/components/autofill/core/common/password_form_fill_data.cc
@@ -96,13 +96,25 @@ PasswordFormFillData MaybeClearPasswordValues(
   // on load. So in case of filling on load nor |password_field| nor
   // |additional_logins| can't be cleared
   bool is_fallback = data.password_element_renderer_id.is_null();
-  if (!data.wait_for_username && !is_fallback) {
-    return data;
-  }
   PasswordFormFillData result(data);
-  result.preferred_login.password_value.clear();
+  if (data.wait_for_username || is_fallback) {
+    result.preferred_login.password_value.clear();
+    for (auto& credentials : result.additional_logins) {
+      credentials.password_value.clear();
+    }
+    return result;
+  }
+  // Even when filling on load, never expose cleartext passwords for
+  // grouped-affiliation (cross-domain) credentials to the renderer until the
+  // user explicitly selects them. The browser will supply the password via a
+  // separate FillCredential() round-trip after explicit user selection.
+  if (result.preferred_login.is_grouped_affiliation) {
+    result.preferred_login.password_value.clear();
+  }
   for (auto& credentials : result.additional_logins) {
-    credentials.password_value.clear();
+    if (credentials.is_grouped_affiliation) {
+      credentials.password_value.clear();
+    }
   }
   return result;
 }