Elliott Kember found that saved passwords in Chrome are viewable as plain text with the click of a button - all without a master password:
Google isn’t clear about its password security.
In a world where Google promotes its browser on YouTube, in cinema pre-rolls, and on billboards, the clear audience is not developers. It’s the mass market - the users. The overwhelming majority. They don’t know it works like this. They don’t expect it to be this easy to see their passwords. Every day, millions of normal, every-day users are saving their passwords in Chrome. This is not okay.
Open indeed.