One possible way to exploit this is: - user copy-and-pastes password - user forgets to clear clipboard - user opens a link in a new tab with middle-click

One possible way to exploit this is: - user copy-and-pastes password - user forgets to clear clipboard - user opens a link in a new tab with middle-click - link was actually a text form - middle-click pasted the password into the textfield (only on platforms with middle-click configured as paste) I noticed this when I had an image url in my clipboard and tried on open a link on imgur.com in a new tab. Instead of opening the link, the image url in my clipboard was uploaded.