Collected research

Automated Password Extraction Attack on Modern Password Managers

[1309.1416] Automated Password Extraction Attack on Modern Password Managers

Raul Gonzalez, Eric Y. Chen and Collin Jackson · arXiv.org

Lupin makes a browser's own password manager give up saved credentials: a network attacker injects a login form into any non-HTTPS page and the manager autofills it, including passwords for sites the victim is not visiting and forms whose destination is HTTPS. A crawl of the Alexa top 45,000 found at least 28% vulnerable, and Lupin pulled passwords from 1,000 sites in under 35 seconds.

Record

Document

[1309.1416] Automated Password Extraction Attack on Modern Password Managers

Researcher

Raul Gonzalez, Eric Y. Chen and Collin Jackson

Published by

arXiv.org

Topic

Other

In the archive

• Collected in the 2013 research round

Tags

• https
• tooling
• large-scale-scan
• measurement-study
• javascript
• owasp-a02-2021

This page is the archive's own catalogue record. The research is the work of Raul Gonzalez, Eric Y. Chen and Collin Jackson, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.