How do these password managers correctly identify the password input field on a web page?
Password fields contain input type="password"
in the HTML for the input field. This tells the browser and any associated extensions that input to the field should be treated as sensitive. This is what tells the browser to warn you if you are sending it over an unencrypted connection, and also what causes the input to be replaced with dots. In fact, if you edit the source of the page to remove this, you will notice that the characters you type in are not hidden anymore. A browser extension will be able to access this information as well (it is usually exposed in the extension API), and it uses this to determine which fields are password fields.
Does the browser have any security mechanism to prevent other addons to access the password information, before and after it is filled in?
No. Any other extension with equivalent permissions will have the exact same access. They can see exactly what the password manager is writing to the input field, and will be able to see the password that is being sent. However, it will not be able to read the password database by itself, since one extension cannot read the local database of another extension.
But then wouldn't other programs on the user's local system also be able to recover the password?
Yes, usually. While a master password may be used to encrypt these passwords, a local process running under the same user could easily hijack the browser to read the master key next time it is input. This is because a password manager's purpose is simply to let you use unique passwords for each website so you do not risk reusing the same passwords everywhere. They may add useful features like automatic password generation or encryption with a master key so someone who steals your computer cannot log into your sites, but that is not their primary purpose.
A browser password manager is designed to protect from a few threats, specifically:
A malicious or compromised website which can see the password you provide. If you use the same password for that site as for many other sites, that website will be able to impersonate you. A password manager allows you to seamlessly generate and use secure and unique passwords for every website you register on. A browser-based password manager simply makes integration with your web browsing experience easier.
An attacker who gains offline access to your password manager database, such as a laptop thief. If the password manager uses a master encryption key, which most do, then the thief will not be able to find out what passwords you are using. If the attacker is a local process running on the same machine, all bets are off. Password managers do not and cannot protect from such a threat. Proper system hardening and prompt security updates will.
strace
the syscalls the process makes or record the desktop and recognize the file dialog and which file was selected (I do not type the name, I only select it via mouse). The keyfile could be in an external harddrive that is mounte only for the 5 seconds needed to decrypt the db, in that case it would be extremely hard to get a hand on it. – Bakuriu Jul 2 '18 at 18:08