s>, unlike the extension's other data paths, which check a site whitelist first."},"technicalNote":"content.js:68-93, capturing-phase 'submit' listener, all_frames. Reads input[type=text]/[name=username] and input[type=password]/[name=password] .value, sends chrome.runtime.sendMessage({type:'formsubmit', username, password, url})."},{"kind":"code_compare","caption":"The form-submit listener, as shipped","language":"js","shipped":[{"code":"document.addEventListener('submit', function(event) {\n console.log('addEventListener:');\n\n const form = event.target;\n console.log('addEventListener form :', form);\n\n // Assuming the form contains username and password fields\n const usernameField = form.querySelector('input[type=\"text\"], input[name=\"username\"]');\n const passwordField = form.querySelector('input[type=\"password\"], input[name=\"password\"]');\n\n if (usernameField && passwordField) {\n const username = usernameField.value;\n const password = passwordField.value;\n console.log('Content file : username: password:', username, password);\n\n // Sending data to the background script\n chrome.runtime.sendMessage({\n type: 'formsubmit',\n username: username,\n password: password,\n url: window.location.href\n }, (response) => {\n console.log('Response from background:', response);\n });\n }\n}, true);"}],"deobfuscated":[{"code":"document.addEventListener('submit', function(event) {\n console.log('addEventListener:');\n\n const form = event.target;\n console.log('addEventListener form :', form);\n\n // Assuming the form contains username and password fields\n const usernameField = form.querySelector('input[type=\"text\"], input[name=\"username\"]');\n const passwordField = form.querySelector('input[type=\"password\"], input[name=\"password\"]');\n\n if (usernameField && passwordField) {\n const username = usernameField.value;\n const password = passwordField.value;\n console.log('Content file : username: password:', username, password);\n\n // Sending data to the background script\n chrome.runtime.sendMessage({\n type: 'formsubmit',\n username: username,\n password: password,\n url: window.location.href\n }, (response) => {\n console.log('Response from background:', response);\n });\n }\n}, true);"}],"technicalNote":"This build ships unminified; the deobfuscation pass made no further changes to this file."},{"kind":"field_table","caption":"What the background service worker receives","fields":[{"icon":"user","label":"Username you typed","meaning":"The exact text you entered in the form's username or text field.","sampleValue":"jane.doe@example.com","severity":"identifies"},{"icon":"lock","label":"Password you typed","meaning":"The exact plaintext password you entered, unmasked.","sampleValue":"Summer2024!","severity":"identifies"},{"icon":"url","label":"Page URL","meaning":"The full address of the page where you submitted the form.","sampleValue":"https://accounts.example.com/login","severity":"context"}]},{"kind":"plain_note","title":"What we did and did not observe","body":"Code analysis only: the background script logs the captured credentials with console.log, not a network call. Every other data path here forwards only the domain after a whitelist check; this handler skips that and keeps the raw values."},{"kind":"artifact","purpose":"reproducer","filename":"test-login-form.html","language":"html","description":"A minimal login form that lets you watch the extension capture plaintext credentials in the background service worker console.","code":"\n\nForm capture test\n\n

Form capture test

\n \n

Is FortiEDR Secure Browser safe?

Findings