Chrome's AI Autofill Can Now Read Your Gmail to Fill Forms: How It Works and the Privacy Trade-Off

Google announced on October 28, 2026 that Chrome's AI-powered autofill can now search your Gmail to fill out forms. TechCrunch reports that Chrome can suggest details such as a flight confirmation number, membership ID, tracking information, order number, address, phone number or credit card number by referencing your Gmail. It is an expansion of Google's Personal Intelligence, is opt-in, and is rolling out to US users on desktop and in the iOS and Android apps for Gemini in Chrome.

Traditional autofill fills what the browser saved. This one fills what your email contains. That is convenient and also a larger privacy decision than ticking a box, so this post explains how it works, what Google has said, how it compares with other browsers' AI features, and how to decide.

TL;DR: Chrome AI autofill at a glance

How does the feature work?

Chrome's older autofill matched form fields against saved addresses and cards. The new version uses Gemini with Personal Intelligence to find the right value in connected Google apps. If a form asks for your airline booking reference, the model can locate the confirmation email and offer the code.

The feature has been visible in tests since the summer. Reports on the Canary version in July described "Find and Fill with Gemini", enabled under Autofill and passwords in Chrome settings and drawing on Gmail, Photos and connected apps. Reports on Chrome for Android described a Gemini-powered autofill search sheet. We have not found a Google post for the October rollout, so the details above come from TechCrunch; treat them as reported.

Personal Intelligence is the broader Google feature that lets Gemini use your Gmail, Photos and other data when you opt in. We covered its arrival in cars in Gemini Personal Intelligence on Android Auto. The Chrome autofill is the same permission model reaching a new surface.

What does Google say about privacy?

TechCrunch's piece says Google states that sensitive data is encrypted, and notes no further privacy controls. Read the disclosure Chrome shows when you enable the feature.

The questions worth asking:

• What leaves the device? Probably the form's context and a query. Whether your email text is processed on Google servers, on device, or both, the coverage does not say.
• Is it logged? Look for activity or history controls in your Google account.
• What about pages you do not trust? A malicious page can pose as a form asking for a number. The browser should only fill on user action; the coverage does not say how this is enforced.

For the wider debate on assistants that read your mail, see our analysis of AI agent privacy promises from Meta Muse and OpenAI Dots.

How it compares with other browser AI features

Browsers are racing to put an assistant between you and the web. Firefox's Smart Window offers fill from sources and watch tasks. Opera has proposed a WebAI standard for local models. And ChatGPT has a Chrome extension that can control open tabs. Google's advantage is that it already holds your email, so its autofill needs no new connector.

That advantage is also the risk. A browser feature that depends on your inbox ties form filling to your Google account security. If someone gains access to your account, they also gain access to a faster way to extract numbers from your mail.

Should you turn it on?

Reasons to enable it:

1. You book travel or shop online often and retype confirmation codes.
2. You already use Gemini and Personal Intelligence and accepted their data access.
3. You protect your Google account with a passkey or hardware key.

Reasons to wait:

1. Your Gmail holds sensitive financial or medical messages you do not want surfaced anywhere.
2. You share a computer or a browser profile.
3. You want to see independent privacy analysis first, since the rollout is new.

A middle path: enable it on one device, try it on low-stakes forms, and review the activity controls before using it for card numbers.

A practical test plan before you rely on it

Treat the first week as an experiment. On day one, enable the setting and fill a harmless form, such as a newsletter signup that asks for a name and address, and note what the browser offers and where it says the value came from. On day two, try a form that needs a booking or order number, and check the suggested value against the email yourself; an AI that picks the wrong confirmation email is the likeliest failure, since inboxes hold many similar messages from the same sender. On day three, look through your Google account's activity and privacy pages to see whether anything about the feature is logged, and what controls exist to delete it.

Also think about which messages sit in your mailbox that you would not want a model reading: legal correspondence, medical results, messages from other people who did not consent to being processed. Gmail permission is all-or-nothing in many Personal Intelligence setups, so if the feature cannot be limited to labeled mail, a separate account for sensitive mail is the safest design. Finally, check the settings of any family members or colleagues who share a device, because an enabled profile on a shared machine exposes what it can read to whoever sits down next.

Why this matters beyond convenience

Autofill is one of the most used features in any browser, which makes it a strong test of whether people accept AI reading their personal data in exchange for saved effort. Google has the unusual position of owning the browser, the email and the model. If the feature works well and few users report problems, expect similar links to appear for calendar entries, documents and photos, so a form asking for a document number could be answered from a scanned PDF in Drive.

There is also a security angle that regulators and researchers will watch. Any feature that moves data from a private source into a web page on request is a target for prompt-injection and spoofing attacks, where a hostile page tries to trick the assistant into revealing more than the user asked for. The safeguards that matter are the same as for other agents: act only on explicit user action, show where each value came from, and never fill into a field on a different origin without a clear prompt. We have not seen Google publish a threat model for this feature, so independent testing will be the real evidence.

For people who have been burned by data exposure before, the conservative position is reasonable: keep the feature off until a security review appears, use a password manager for cards, and copy confirmation codes by hand.

Traditional autofill versus Gmail-backed autofill

The difference is the source of truth. Classic autofill only repeats what you chose to save: an address, a phone number, a card. You decided once, and the browser replays it. Gmail-backed autofill instead searches material you never chose to save as form data, such as a confirmation email that arrived last week. That makes it more useful for one-off values like tracking numbers, and it also means the set of things the browser might offer is far larger and harder to predict.

For a cautious user, the practical consequence is that reviewing a suggestion matters more than before. With a saved card, you know what will be filled. With an email-derived value, check the number against the message, especially when several similar emails exist from the same airline, store or carrier.

What is not yet clear

• Whether the October rollout is identical to the earlier Canary test.
• Rollout dates outside the US.
• How long inserted values or queries are retained.
• Whether enterprise Workspace accounts are included.

What it means for builders

Product teams should also plan for support questions. When a form is filled by a model, a wrong value reaches your system looking like user input, so validate booking references and order numbers server-side and show a clear confirmation step before submission. Log whether a field was autofilled if your analytics allow it, so you can spot a spike in errors after a rollout like this one.

If you build web forms, expect more users to arrive with fields pre-filled by an AI that read an email. That can reduce abandonment on booking and checkout pages, and it raises a testing task: confirm your labels and field names are clear enough for a model to match, as you would for accessibility. If you build agents, note that browser vendors are moving agent-like features into the default browser, which narrows the gap for third-party extensions.

Related reading

• Gemini Personal Intelligence on Android Auto
• AI agent privacy promises: Meta Muse and OpenAI Dots
• Firefox Smart Window: fill from sources and watch tasks
• Opera WebAI proposal for local models
• ChatGPT Chrome extension: open tabs and permissions
• Chrome Gemini student features
• Official: TechCrunch's report and Google's Chrome help center

Details are accurate as of October 28, 2026 and rely on press reporting; settings and availability may change.