Are you refering to this one https://marektoth.com/blog/dom-based-extension-clickjacking https://marektoth.com/blog/dom-based-extension-clickjacking? This does

Are you refering to this one https://marektoth.com/blog/dom-based-extension-clickjacking https://marektoth.com/blog/dom-based-extension-clickjacking? This doesn't seem to be "passwords on random pages", only "Personal Data + Credit Card,", passwords are domain-specific unless the website is hacked itself. > The attacker can only steal credentials for the vulnerable domain.