My naive fix would be to disable extensions from accessing form field data without explicit approval. Hell, add different approval boxes for read, write, and hidden-text.
What am I missing?
What am I missing?
Never mind the technical challenge to allow doing anything with the DOM but disallow reading the forms. Like, prevent the forms leaking its text when you do funny things like testing character width via line breaking or font changes.