1635007 - Utilising the autofill functionality for information exfiltration

Status: RESOLVED DUPLICATE of bug 1392944

(Toolkit :: Form Autofill, enhancement)

Description

[Panagiotis Ilia]

Attachment: Disclosure_firefox.pdf

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36

Steps to reproduce:

Web pages can use various techniques to hide input elements in a form, in order to exfiltrate user sensitive information in a stealthy way. Also, the autofill warning message that is shown does not adequately inform the user about what information will actually be provided to the form, as it only shows the generic categories of this information. Please check the attached file for more details.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 2

[Matthew N. [:MattN]]

Thanks for the research. I will reply in bug 1392944.