See how malicious websites can use hidden form fields to steal your personal information through browser autofill.
How This Attack Works
When you use browser autofill, it fills ALL matching fields on a page - even ones you can't see. A form asking for just your name might secretly have hidden fields for your credit card, address, and phone number.
Hidden Fields
Fields positioned off-screen or with zero dimensions that autofill still populates.
Invisible Fields
Fields with opacity: 0 or visibility: hidden that still receive autofill data.
Covered Fields
Fields hidden under other elements but still functional for autofill.
Demo 1: "Simple Contact Form"
Looks innocent - just asks for your name and email. Click in a field and use autofill to see what happens.
Data That Would Be Stolen:
Demo 2: "Newsletter Signup"
A typical newsletter form - just wants your email, right? Try autofill and see what else it grabs.
Data That Would Be Stolen:
Demo 3: "Quick Checkout" (Most Dangerous)
Appears to be a simple form, but has hidden credit card fields. This is the scariest attack vector.
Data That Would Be Stolen:
Why Does This Work?
Browsers match form fields by their autocomplete attribute and name
Autofill doesn't check if fields are visible - it fills everything that matches