> This title seems a bit over-broad. The attack is based on using the built-in chrome credential manager I'm reading the white paper[and from what I understand

> This title seems a bit over-broad. The attack is based on using the built-in chrome credential manager I'm reading the white paper[and from what I understand the password manager attack is just a sample. The vulnerability exposes data from other tabs that get consolidated on the same process, so it doesn't matter if it came from the password manager or if you typed it, it's grabbing it either way. They even managed to leak an image uploaded on a different tab. (page 13, figure 14 https://www.spookjs.com/files/spook-js.pdf https://www.spookjs.com/files/spook-js.pdf)