HTML Injection Bypasses Strict CSP to Steal Chrome Autofill Passwords
A new technique shows that attackers can steal saved passwords via HTML injection even when a site enforces a strict Content Security Policy that blocks JavaScript. By injecting a fake form, Chrome’s password autofill fills it, and the attacker exfiltrates the credentials using the Referer header, requiring only a single click.