Correct, and this is the point that is being missed by so many, despite their hyperbole. Chrome could prevent the display of the password as a design choice, but the password must be reversible otherwise how could you send it on to the authenticating server? Only the authenticating server stores non-reversible hashes.