Password Autofill Abused via HTML Injection | AFINE
afine.com
Turning a reflected HTML injection under a strict CSP into full credential theft by chaining password autofill with Referer header leakage.