When built-in password manager is opened, Brave connects to all sites in the list in order to fetch favicon data

[Brave-Matt]

Description

A user recently brought to our attention that the Password manager in the browser will connect to all the sites in the list of saved passwords when the brave://password-manager/passwords page is opened. It appears to do this simply to fetch the favicons for those sites to be displayed on the page.

While these connections are not malicious/nefarious, it is certainly not a great look given Brave's stance on privacy. It is at least worth discussing changing this behavior and/or removing the favicons from the page so that that these connections are not made.

cc @fmarier

Steps to reproduce

1. Launch network analyzer (mitmproxy, little snitch, wireshark, etc)
2. Launch Brave, open password manager page
3. Observe browser connecting to each site

Actual result

Brave connects to all site in the list

Expected result

Brave should not connect to these sites every time

Reproduces how often

Easily reproduced

Brave version (brave://version info)

1.73.101

Channel information

• release (stable)
• beta
• nightly

Reproducibility

• with Brave Shields disabled
• with Brave Rewards disabled
• in the latest version of Chrome

Miscellaneous information

Original user report:
https://community.brave.com/t/brave-needs-to-stop-contacting-every-website-in-my-password-manager/587282/3

[rebron]

cc: @goodov

[goodov]

https://chromium-review.googlesource.com/c/chromium/src/+/4032157

the added cr-auto-img element logic needs to be disabled, favicon div should be the main source of the icon (it only uses locally-cached icons).

[goodov]

cc @fallaciousreasoning any chance someone more familiar with webui overrides can pick this up?

brave/brave-core#27066

[MadhaviSeelam]

Verification PASSED using

Brave | 1.75.171 Chromium: 132.0.6834.160 (Official Build) (64-bit)
-- | --
Revision | d4d146998a285171ea57c3b75c52c7819901571a
OS | Windows 11 Version 24H2 (Build 26100.2894)

Reproduced the issue in 1.73.101 Chromium: 131.0.6778.139 (Official Build) (64-bit) using the STR from #42955 (comment)

example	example

Confirmed no connections are shown when built-in password manager is opened

example	example