Is FortiEDR Secure Browser strengthens security with safe browsing. safe?
FortiEDR Secure Browser reads the plaintext username and password from every web form you submit, on any site.
A content script runs on every page you visit and listens for form submissions. When a form has a text/username field and a password field, it reads both values in the clear and sends them to the extension's background service worker, which logs them to its own console. This happens on any site with a login-style form, not only sites the extension is meant to monitor, and in the current version the captured credentials are not sent to any outside server.
Who publishes itFortinet - 6 other listings from the same operator, 1 of them carrying a finding
Fortinet - 6 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 3 users between them, none of them carrying a finding.
Same operator - 5 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
FortiEDR Secure Browser reads plaintext passwords from login forms you submit
Code analysis shows the extension's content script reads the username and password fields from any login form on any website and forwards them, unencrypted, to its own background service worker when you submit the form.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Static analysis
You fill in a username and password on any website and submit the form.
The content script listens for form submissions on every page, because the extension's content script runs on <all_urls>.
The extension reads both field values in the clear and sends them to its own background service worker.
The message includes the plaintext username, the plaintext password, and the full page URL.
- Usernamejane.doe@example.com
The plaintext value typed into the username or text-type field.
- PasswordSummer2026!
The plaintext value typed into the password field, unmasked and unhashed.
- Page URLhttps://portal.example.com/login
The full address of the page where the form was submitted.
The capture path, and the policy-check pattern it skips
Not applicable: content.js and background.js ship as readable, non-minified source in this build. The three panes above are the shipped code as-is, shown side by side to contrast the formsubmit handler against the extension's own policy-check pattern used for copy and paste events.In this version the captured credentials go to the background worker's own console log; no outbound request or native-messaging call carrying them off the device was found. Two sibling listings ship the same code with the same finding.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.