Collected research

Stealing entire Auto-Complete data in Google Chrome

lava · blog.andlabs.org

Chrome's autocomplete dropdown is not in the DOM, so script cannot read it. The trick is to place a 3px-wide input just above the resting mouse pointer so the suggestion list appears under it, camouflaged as a thin strip. A fake reaction game gets the victim to press Enter repeatedly, each press committing one suggestion into the input where JavaScript reads it.

Record

Researcher

lava

Published by

blog.andlabs.org

Topic

Browser

In the archive

• Collected in the 2010 research round

Related sources

• Safari auto-complete hack
• Auto-complete extraction demonstration
• Auto-complete extraction demonstration

Tags

• info-leak
• javascript
• dom
• css
• ui-redress
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of lava, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.