Is autocomplete=“off” compatible with all modern browsers?

Question

There are a lot of answers on the subject (including some on StackOverflow), but none of them have recent or updated answers: I can't seem to find any documentation indicating which browsers support autocomplete="off". Can anyone point me in the right direction of a chart of form attributes and browser compatibility?

Password and Username caching on the browser allows an attacker, if by using sophisticated CSRF attack against the protected storage of the browser, or if by physical access to the victims machine to steal the victims credentials.

As a security consultant who wants to give the best practice and most secure solutions to his clients I want to make sure recommending AutoComplete="off" is the right solution to order the browser not to cache the user's credentials. For this I need to know if there are any browsers that don't apply this rule. If such case exists I need to recommend on another solution. Pentesters among us might want this information to R&D special attacks against such browsers, and users might be interested in such information to know what browsers not to use.

Answer 1

Exact duplicate of SO question (which is more relevant than here): https://stackoverflow.com/questions/3868299/is-autocomplete-off-compatible-with-all-modern-browsers

Basically, most modern browsers attempt to respect it, though it would be trivial to write an javascript extension to ignore/disable it. E.g., with jQuery library they could do something like add the following javascript to every page:

$(document).ready(function() {
 $(":input").attr('autocomplete', 'on');
}

which would override the autocomplete settings of the website. Basically, your best bet is to set autocomplete='off' and additionally set a policy to tell users to never have the browser remember the password for this website.