Had this happen about 2 weeks ago when I was booking a hotel. This was not a chat window, like the article, but a hotel booking form. I had a few tabs open and filled in the booking information but found something a little more convenient. So, I did not submit the form and closed the tab. About 2-3 minutes later my phone started to ring. It was a customer service agent from that incomplete booking website asking if I needed a better deal!? This was extremely creepy! I guess they are grabbing the form data via xhr requests or something (pre-submit). Not only that they do this, but the speed at which they can action it, makes me think we're in a whole new ball game.

I had a workmate mock order some stickers and put in their boss's email, but did not submit. That evening, the boss got an email with the order, and the boss bought them (they were previously informed of the idea), thinking the employee had sent the order over.

This is old news. It's fairly easy to implement and most often done with simple google sheets.

Think you can give a short example code?

document.getElementById('myInput').addEventListener('change', event => fetch('https://myapi/textBoxData', {method: 'POST', body: event.target.value})

It's amazing this still works in Chrome.

Open https://anttiviljami.github.io/browser-autofill-phishing/ , enter some auto-fill info, click "Submit" and monitor your "Network" tab requests. You'll find your browser leaked way more info than those 2 information...

We had to deal with this in reverse: we had a form that depending on what you fill in and the settings doesn't show some options.

The browser was submitting the form with auto-fill details that failed the validation checks for those fields. Hard to show an error message for fields the user can't see.

Yes, it is more robust to have code on the server side discard input that isn't expected rather than validate it, but it annoying extra work when those fields have no security impact.

The alternative is to tell the browser not to auto-fill those fields, but doing that feels broken too.

scary... is there any valid scenario where user expects browser to auto-fill the hidden fields?

Just pretty difficult to ensure a field really is visible to the user, the problem is it'll always have some weaknesses and those who would abuse it will find those weaknesses

Yeah, that’s why Safari no longer autofills until you tell it to.

Firefox does it for passwords if you pick to save your password but other fields I just have to double click the field and it drops down with a list of things I have put in it before.

Is there a way to change Firefox's behavior for passwords so that I need to click to fill them in? I couldn't find anything in a quick Google search.

Password should be saved per-site. Like, I think they actually are.

You're right, that mitigates most of the risk.

Firefox seems to save passwords per domain name. This may not be specific enough in certain cases. E.g., if I have a password on domain.com, but domain.com offers web hosting at domain.com/username, then my understanding is it would be relatively easy to obtain my credentials for domain.com with the right phishing site at domain.com/username. Correct me if I'm wrong.

The entire web security model breaks down in this case. No web hosting except the most hacked together system does this. They all provide sub domains or sanitize the content so it can't run any code. Like the sibling comment pointed out, you could just use JS to grab your login cookie from the other site.

Good points. Unfortunately there are a lot of "hacked together" services out there.

I can think of one site I had to use recently for event registration which suffered from the flaw I mentioned. (Note that I have no choice over which service to use here, as I don't run the event.) The site puts each event under different directories, not subdomains as it should. Firefox saved my login details for one past event and wanted to use them for another event. I don't know the extent by which the event pages can be customized, but if you could put the right JS on one event page then it seems there are multiple approaches to getting credentials and potentially obtaining sensitive information. Fortunately in this case an attacker wouldn't obtain much of value best I can tell.

In that case, cookies would be completely insecure as well

Does the browser actually enter the CC before you pick it? I don't think it does...