1567749 - form data (autocomplete dropdown) can be accessed by third parties

Status: RESOLVED DUPLICATE of bug 381681

(Toolkit :: Form Manager, defect)

Description

[Thorin [:thorin]]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0

Steps to reproduce:

see: https://blog.mindedsecurity.com/2011/10/autocompleteagain.html which contains a link to a PoC which still works (last tested in FF67)

It is possible to get key down / up events via JavaScript when a drop down autocomplete menu is shown. This means that it is possible to lure a user to play a game and steal arbitrary values from browsers autocomplete feature.

Actual results:

data leaked to a third party

Expected results:

2 potential ways of fixing it

• checking origin (limit to first party?): and/or applying Origin Attributes (PB, Containers, FPI)
• not sending key down/up events when that menu is shown

From the article (but I have no tested: article is 8 years old)

Google chrome at least does not send keydown/keyup events to JS when the autocomplete drop down menu is focused

Comment 1

[Jonathan Kingston [:jkt] he/him]

This is a duplicate of Bug 1427543, thanks for filing!

Comment 2

[Daniel Veditz [:dveditz]]

the pref in bug 1427543 is specific to the password manager and wouldn't resolve this bug (we do probably have a dupe somewhere, though).