No sensitive fields captured from DOM without user interaction

Content scripts run in the context of every web page the user visits, giving them direct DOM access to password fields, credit card inputs, and API key fields. Automatically reading these values — even for seemingly benign purposes like autofill — is classified as unauthorized data access under OWASP 2021 A02 and CWE-200. A compromised extension or malicious update can silently exfiltrate credentials at scale across every site the user visits. The Chrome Web Store User Data Policy explicitly prohibits capturing sensitive fields without user initiation; violations result in immediate takedown and potential account termination.

Remove all automatic sensitive field access from content scripts. If your extension must interact with credential fields, require a preceding user gesture:

// content.js — only activate on explicit user click
document.addEventListener('click', (e) => {
  if (e.target.matches('input[type="password"]')) {
    if (confirm('Allow extension to read this field?')) {
      const value = e.target.value;
      // process value
    }
  }
});

For legitimate credential management, use the browser's native Credential Management API with explicit user consent rather than direct DOM reads.