I saw in the linked GitHub issue that autofill now doesn’t fill invisible elements, which is a great security improvement (even though it is having some side-effects in the current implementation)! Was this just implemented in 2023.12.0?
I have been interested in this issue (vulnerabilities associated with invisible form fields) for some time, and wrote a comment back in March that summarizes my thoughts on the matter — including several proposed strategies for mitigating the risks. If you have the time to read the comment linked below, I would really appreciate it:
As you work to resolve the caching issues in Issue #7202, I would just like to offer my opinion that I hope you will not deal with these difficulties by disabling or watering down the new functionality for preventing autofilling of nonvisible elements. I think it should be in principle be possible to update your cache when a user requests autofilling (via keyboard shortcut, right-click context menu, etc.), and I think it would be perfectly reasonable for autofill on page load to not work on such sites (i.e., I really hope that you don’t water down the new feature just to accommodate those users who have enabled autofill on page load).