This has been used in the wild in XSS payloads for years now. For eg. check this presentation from Stratsec at EUSecWest '09[0] specifically slide 35 which tal

This has been used in the wild in XSS payloads for years now. For eg. check this presentation from Stratsec at EUSecWest '09[0] specifically slide 35 which talks about exploiting password managers. see 'Abusing Password Managers with XSS' from Neohapsis[1] also the Beef project has a module called Get Stored Credentials[2] The reason it was only one slide in the presentation and so little else has been written about it? First, because it is obvious - when learning XSS after cookies and sessions the next thing most devs go at is the password manager. And second, it just isn't as interesting when you have so much more you can do with XSS, and tampering with password managers is a narrow vector. [0] http://www.stratsec.net/getattachment/09ce9a5a-07d2-41ca-8430-3c51a18a59b7/stratsec---EUSecWest-2009---Writing-Better-XSS-Payloads.pdf http://www.stratsec.net/getattachment/09ce9a5a-07d2-41ca-843... [1] http://labs.neohapsis.com/2012/04/25/abusing-password-managers-with-xss/ http://labs.neohapsis.com/2012/04/25/abusing-password-manage... [2] http://beefproject.com/ http://beefproject.com/