Clear password values before sending them to the renderer process.

components/password_manager/content/browser/content_password_manager_driver.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/password_manager/content/browser/content_password_manager_driver.h"
 
 #include "components/autofill/content/browser/content_autofill_driver.h"
 #include "components/autofill/core/common/form_data.h"
 #include "components/autofill/core/common/password_form.h"
 #include "components/password_manager/content/browser/bad_message.h"
@@ skipping 67 matching lines @@
 
 void ContentPasswordManagerDriver::BindSensitiveInputVisibilityServiceRequest(
     blink::mojom::SensitiveInputVisibilityServiceRequest request) {
   sensitive_input_visibility_bindings_.AddBinding(this, std::move(request));
 }
 
 void ContentPasswordManagerDriver::FillPasswordForm(
     const autofill::PasswordFormFillData& form_data) {
   const int key = next_free_key_++;
   password_autofill_manager_.OnAddPasswordFormMapping(key, form_data);
-  GetPasswordAutofillAgent()->FillPasswordForm(key, form_data);
+  GetPasswordAutofillAgent()->FillPasswordForm(
+      key, autofill::ClearPasswordValues(form_data));
 }
 
 void ContentPasswordManagerDriver::AllowPasswordGenerationForForm(
     const autofill::PasswordForm& form) {
   if (!GetPasswordGenerationManager()->IsGenerationEnabled())
     return;
   GetPasswordGenerationAgent()->FormNotBlacklisted(form);
 }
 
 void ContentPasswordManagerDriver::FormsEligibleForGenerationFound(
@@ skipping 240 matching lines @@
 ContentPasswordManagerDriver::GetPasswordGenerationAgent() {
   if (!password_gen_agent_) {
     render_frame_host_->GetRemoteInterfaces()->GetInterface(
         mojo::MakeRequest(&password_gen_agent_));
   }
 
   return password_gen_agent_;
 }
 
 }  // namespace password_manager