domain-a login form

This page represents an attacker-controlled origin for which the victim has previously saved a password. Simply rendering the form below — with no user interaction — causes the browser to push a PasswordFormFillData structure to this renderer process. If the user also has a saved password for a separate origin that the affiliation service places in the same "group", that cross-domain password is included in cleartext.

A compromised renderer would now read additional_logins from its own memory. See the [POC][RENDERER] lines on stderr for what is exposed.