Collected research

Leaky Forms: A Study of Email and Password Exfiltration Before Form Submission

Asuman Senol, Gunes Acar, Mathias Humbert and Frederik Zuiderveen Borgesius · usenix.org

A crawl of the top 100,000 sites measuring third-party scripts that read email addresses and passwords out of forms before the user submits them. Emails leaked to trackers on 1,844 EU and 2,950 US sites without consent, 41 leaking domains appeared on no blocklist, and session-replay scripts incidentally collected passwords on 52 sites.

Record

Researcher

Asuman Senol, Gunes Acar, Mathias Humbert and Frederik Zuiderveen Borgesius

Published by

usenix.org

Topic

Other

In the archive

• Collected in the 2022 research round

Related sources

• CIF Seminar - Q&A "Leaky Forms: A Study of Email and Password Exfiltration Before..." (Asuman Senol)
• CIF Seminar - "Leaky Forms: A Study of Email and Password Exfiltration Before..." (Asuman Senol)
• USENIX Security '22 - Leaky Forms: A Study of Email and Password Exfiltration Before Form Submission

Tags

• info-leak
• javascript
• dom
• large-scale-scan
• measurement-study

This page is the archive's own catalogue record. The research is the work of Asuman Senol, Gunes Acar, Mathias Humbert and Frederik Zuiderveen Borgesius, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.