=== VULNERABLE RUN (PasswordFormGroupedAffiliations enabled) === [POC][BROWSER] Injecting environment: 1 exact-match credential for http://localhost:18472/, 1 grouped cross-domain credential for https://crossdomain.test/ [POC][BROWSER] Sending PasswordFormFillData over Mojo to renderer (wait_for_username=0). preferred_login: realm="" user="userA_local" pwd="local_pwd_A". additional_logins(1): [POC][BROWSER] -> realm="https://crossdomain.test/" user="userB_crossdomain" pwd="SECRET_CROSS_DOMAIN_PASSWORD_B" is_grouped_affiliation=1 [POC][RENDERER pid=866] Received PasswordFormFillData via IPC for url=http://localhost:18472/poc.html, wait_for_username=0 [POC][RENDERER pid=866] preferred_login: realm="" user="userA_local" pwd="local_pwd_A" [POC][RENDERER pid=866] additional_login: realm="https://crossdomain.test/" user="userB_crossdomain" pwd="SECRET_CROSS_DOMAIN_PASSWORD_B" is_grouped_affiliation=1 [POC][RENDERER pid=866] *** LEAK: cross-domain (https://crossdomain.test/) cleartext password "SECRET_CROSS_DOMAIN_PASSWORD_B" is readable in renderer memory without user interaction *** [POC][BROWSER] Injecting environment: 1 exact-match credential for http://localhost:18472/, 1 grouped cross-domain credential for https://crossdomain.test/ [POC][BROWSER] Sending PasswordFormFillData over Mojo to renderer (wait_for_username=0). preferred_login: realm="" user="userA_local" pwd="local_pwd_A". additional_logins(1): [POC][BROWSER] -> realm="https://crossdomain.test/" user="userB_crossdomain" pwd="SECRET_CROSS_DOMAIN_PASSWORD_B" is_grouped_affiliation=1 [POC][RENDERER pid=866] Received PasswordFormFillData via IPC for url=http://localhost:18472/poc.html, wait_for_username=0 [POC][RENDERER pid=866] preferred_login: realm="" user="userA_local" pwd="local_pwd_A" [POC][RENDERER pid=866] additional_login: realm="https://crossdomain.test/" user="userB_crossdomain" pwd="SECRET_CROSS_DOMAIN_PASSWORD_B" is_grouped_affiliation=1 [POC][RENDERER pid=866] *** LEAK: cross-domain (https://crossdomain.test/) cleartext password "SECRET_CROSS_DOMAIN_PASSWORD_B" is readable in renderer memory without user interaction *** === CONTROL RUN (PasswordFormGroupedAffiliations disabled) === [POC][BROWSER] Injecting environment: 1 exact-match credential for http://localhost:18472/, 1 grouped cross-domain credential for https://crossdomain.test/ [POC][BROWSER] Sending PasswordFormFillData over Mojo to renderer (wait_for_username=0). preferred_login: realm="" user="userA_local" pwd="local_pwd_A". additional_logins(0): [POC][RENDERER pid=1301] Received PasswordFormFillData via IPC for url=http://localhost:18472/poc.html, wait_for_username=0 [POC][RENDERER pid=1301] preferred_login: realm="" user="userA_local" pwd="local_pwd_A" === POST-FIX RUN (bandaid-fix.patch applied, PasswordFormGroupedAffiliations enabled) === [POC][BROWSER] Injecting environment: 1 exact-match credential for http://localhost:18472/, 1 grouped cross-domain credential for https://crossdomain.test/ [POC][BROWSER] Sending PasswordFormFillData over Mojo to renderer (wait_for_username=0). preferred_login: realm="" user="userA_local" pwd="local_pwd_A". additional_logins(1): [POC][BROWSER] -> realm="https://crossdomain.test/" user="userB_crossdomain" pwd="" is_grouped_affiliation=1 [POC][RENDERER pid=2125] Received PasswordFormFillData via IPC for url=http://localhost:18472/poc.html, wait_for_username=0 [POC][RENDERER pid=2125] preferred_login: realm="" user="userA_local" pwd="local_pwd_A" [POC][RENDERER pid=2125] additional_login: realm="https://crossdomain.test/" user="userB_crossdomain" pwd="" is_grouped_affiliation=1 [POC][BROWSER] Injecting environment: 1 exact-match credential for http://localhost:18472/, 1 grouped cross-domain credential for https://crossdomain.test/ [POC][BROWSER] Sending PasswordFormFillData over Mojo to renderer (wait_for_username=0). preferred_login: realm="" user="userA_local" pwd="local_pwd_A". additional_logins(1): [POC][BROWSER] -> realm="https://crossdomain.test/" user="userB_crossdomain" pwd="" is_grouped_affiliation=1 [POC][RENDERER pid=2125] Received PasswordFormFillData via IPC for url=http://localhost:18472/poc.html, wait_for_username=0 [POC][RENDERER pid=2125] preferred_login: realm="" user="userA_local" pwd="local_pwd_A" [POC][RENDERER pid=2125] additional_login: realm="https://crossdomain.test/" user="userB_crossdomain" pwd="" is_grouped_affiliation=1