A Flaw in Modern Browsers but Never Gets Concerned

Modern browsers including Chromium-based and Firefox, etc. has an unsecure mechanism for password filling but they never concern, why?

Every browser now has password manager feature built-in. The password manager usually get unlocked by entering system password, Windows, macOS, etc.

However, for the filling procedure, browsers will happily fill the password field for user (or stranger in front of the display).

The problem is DevTools in browser has a variable called '$0' which is the selected tag in Inspect mode. Anyone can do right-click and inspect the password field and type this to see the password:

$0.value

Even if the account is logged it, log it out first and browser will fill the password. A suggestion for the issue is browsers should give user option to type a short PIN before auto-filling.

Should physical-local attack be considered?:

Ref: https://groups.google.com/a/chromium.org/g/security-dev/c/UDRW-YukLoI