Chrome Skills Autofilled My Invoice App — 2 Of 4 Wrong

By Lazar Milicevic · Published August 27, 2026 · 7 min read

Google I/O 2026 dropped three Chrome AI updates. The one nobody's talking about quietly hijacks form fields on the SaaS tools your customers already use. I pointed Skills at my live invoicing dashboard within 24 hours of the keynote, and 1.3 seconds later I had a legally invalid invoice queued to send to the wrong company.

The three Chrome AI updates, ranked by how much they'll break your app

Of the three I/O 2026 Chrome updates — WebMCP, Built-in AI (Gemini Nano), and Skills — only Skills changes user behavior on sites you already shipped without asking your permission. WebMCP and Built-in AI are opt-in developer APIs; you choose to adopt them. Skills reads accessibility metadata and account memory on any form, right now, on tools you don't control.

Here's the honest breakdown:

Most dev coverage led with WebMCP because it's the shiny agent story. It's the wrong lead. WebMCP is a feature you choose. Skills is a feature that adopts you.

What Skills actually does when a user opens your form

Skills reads a form's DOM structure, extracts field intent from aria-label, name, placeholder, autocomplete, and surrounding context, then autofills from three sources: prior browsing history, system clipboard, and connected Google account memory (contacts, recent addresses, payment profiles, prior form submissions across sites). No page-level opt-in required. No permission prompt at fill time.

My invoicing dashboard has a six-field new-invoice form:

• client name
• client VAT number
• invoice number
• issue date
• due date
• line items

I opened Chrome Canary with Skills enabled, logged in as a test tenant, and clicked New Invoice. Timing from click to populated form: 1.3 seconds. Result:

Four of six filled, two of the four wrong. That's a 50% error rate on the fields Skills touched — and both errors were on the fields that matter legally.

Why your customer will blame you, not Google

If a user hits Save without re-reading, they've just issued an invoice with the wrong tax ID to the wrong company and a payment window their contract doesn't permit. The support ticket lands in your inbox, not Google's. The refund request, chargeback, or compliance letter has your logo on it.

This is the part every SaaS founder should internalize: users don't have a mental model for "the browser filled that in." They clicked New Invoice in your app, they saw fields populate, they pressed Save. In their story, your app sent the wrong invoice. You can be right about Skills being the cause and still eat the ticket, the refund, and the reputation hit.

The asymmetry is brutal:

• Google's cost of a bad Skills autofill: zero. They shipped a feature.
• Your cost: support time, refund, possible tax filing correction, trust damage with a paying customer.

Two lines of defense you ship this week

Two HTML changes per high-risk field neutralize most of the risk. I audited my full invoice form in about 20 minutes.

Defense 1 — sharpen your labels. Skills matches fields by semantic similarity. A generic aria-label="Tax ID" matches any tax-shaped value in memory. A specific, context-bound label makes matching ambiguous enough that Skills defers.

<!-- Before: Skills will happily autofill from any prior VAT -->
<input
  type="text"
  name="tax_id"
  aria-label="Tax ID"
  placeholder="VAT number"
/>

<!-- After: specific to record + context -->
<input
  type="text"
  name="client_vat_number_current_invoice"
  aria-label="VAT number for client on this invoice (must match client record)"
  placeholder="Enter VAT for selected client"
  data-skills="off"
  autocomplete="off"
/>

Defense 2 — declare data-skills="off" on anything legal, financial, or identity-shaped. Chrome respects the hint the way it respects autocomplete="off", but stricter — Skills is designed to defer when the site signals intent. The fields that should get it:

• Tax IDs (VAT, EIN, sales tax registration numbers)
• Bank account and routing numbers
• Payment amounts on invoices, refunds, transfers
• Due dates and contract dates
• Legal entity names on filings
• Any field bound to a compliance record (KYC, AML, GDPR data subject requests)

Applied to my form:

<form id="new-invoice">
  <!-- Safe to autofill -->
  <input name="client_display_name" aria-label="Client display name" />
  <input name="issue_date" type="date" aria-label="Invoice issue date" />

  <!-- High risk: block Skills -->
  <input
    name="client_vat_number_current_invoice"
    aria-label="VAT number for the selected client"
    data-skills="off"
    autocomplete="off"
  />
  <input
    name="invoice_due_date"
    type="date"
    aria-label="Due date based on client payment terms"
    data-skills="off"
  />
  <input
    name="invoice_total_usd"
    type="number"
    aria-label="Invoice total in USD"
    data-skills="off"
    autocomplete="off"
  />
</form>

That's the minimum. It costs you nothing and it removes the most common Skills failure mode: pulling a plausibly-shaped value from an unrelated record.

The third defense: assume users will override you

Some users will paste, some will retype, some will hit Save without reading. Defenses 1 and 2 keep Skills out. You still need runtime validation that catches human error and any autofill that slips through.

The rule I added to my invoice pipeline: if a VAT number changes between invoices for the same client, show a soft blocker. Not a hard stop — legitimate corrections happen — but a confirmation dialog that names the previous value.

# invoice_service.py — runs on submit, before persist
def validate_invoice_before_save(invoice, client, history):
    warnings = []

    # VAT drift check
    last_invoice = history.last_for_client(client.id)
    if last_invoice and invoice.client_vat != last_invoice.client_vat:
        warnings.append({
            "field": "client_vat",
            "severity": "confirm",
            "message": (
                f"VAT changed from {last_invoice.client_vat} "
                f"to {invoice.client_vat} for {client.name}. "
                "Confirm this is intentional."
            ),
        })

    # Due date vs client terms
    expected_due = invoice.issue_date + client.payment_terms_days
    if invoice.due_date != expected_due:
        warnings.append({
            "field": "due_date",
            "severity": "confirm",
            "message": (
                f"Due date {invoice.due_date} does not match "
                f"client terms (+{client.payment_terms_days} days). "
                f"Expected {expected_due}."
            ),
        })

    return warnings

Two checks. Both catch the exact errors Skills made on my form. Both would catch a rushed human making the same mistake — which is the point. The right defensive layer doesn't care whether the bad value came from a browser feature or a distracted user.

Your this-week checklist

• Grep the codebase for every form field touching tax, banking, payment amount, contract date, or identity.
• Add data-skills="off" and autocomplete="off" to each.
• Rewrite aria-labels to be specific to the current record, not the generic concept.
• Add server-side validation that flags drift against prior values for the same entity.
• Test one form under Chrome Canary with Skills enabled before shipping.

Why bizflowai.io helps with this

Invoice-adjacent audits like this are the kind of work I run for clients through bizflowai.io — sweeping a live SaaS form set for high-risk fields, generating the label + attribute patch, and wiring server-side drift validation so any autofilled value (Chrome Skills, password manager, browser extension, or a tired human) gets a confirmation step before it hits the database. Same pattern applies to KYC forms, ACH payment setup, contract signing flows, and any B2B onboarding where a wrong-looking value silently accepted becomes a compliance ticket next quarter.

The scoreboard on I/O 2026 for SMB SaaS

If you sell software that opens in Chrome, rank the I/O 2026 updates by how much they change your Monday morning:

1. Skills — audit your forms this week. It ships to stable Chrome and the first wrong autofill on your app becomes a support ticket you didn't budget for.
2. WebMCP — read the spec, decide if agent integration is on your roadmap, ship next quarter if it fits.
3. Built-in AI — interesting if you're building a Chrome extension. Skip otherwise.

The dev press led with #2 because agents are more fun to write about than form attributes. Your customers don't care what's fun to write about. They care whether the invoice they sent has the right tax ID on it.

Skills is the update that adopts you. Get in front of it before it gets in front of your users.

Want more like this?

I publish practical AI automation, GenAI engineering, and faceless content workflows on YouTube every week.

Subscribe to bizflowai.io on YouTube — never miss a new tutorial.

Planning an AI automation project or need a second opinion on your architecture?

Connect with me on LinkedIn — Lazar Milicevic, GenAI Engineer & bizflowai.io Founder.

Visit bizflowai.io for our services, case studies, and AI consulting.