Consider a website using https which presents a login form on the home page. Today I visited such a website, which I have a login and password for, and for the first time I was presented with a warning about an invalid SSL certificate, in this case because of a slightly different domain name on the certificate (e.g. stack-exchange.com if I had been visiting stackexchange.com, without knowledge of whether one is an alias of the other).
I notified the website administrator via another route and do not intend to log in (or fill in any other details) until the certificate problem is resolved. However, after seeing the warning on the SSL certificate, I clicked through to see whether the site appears to be the same.
The page looked normal and Chrome's autofill feature automatically filled in my username and obscured password.
If the site had been intercepted/replaced by a malicious party, would that party be able to gather login information from autofill without the user clicking to login?