I just took a look in my bug tracking software and noticed a lot of client-side errors that look like this:

SecurityError SecurityError (DOM Exception 18): Blocked a frame with origin "https://example.com" from accessing a frame with origin "https://staticxx.facebook.com". The frame being accessed set "document.domain" to "facebook.com", but the frame requesting access did not. Both must set "document.domain" to the same value to allow access. 
    https://example.com/path:1:368 hasPasswordField_
    https://example.com/path:1:499 hasPasswordField_
    https://example.com/path:1:173 findPasswordForms
    https://example.com/path:10:27 global code

My website does not have any JavaScript with functions named findPasswordForms or hasPasswordField_. So is a script from Facebook looking at my website’s DOM and trying to find password fields?

  • I think its something to do with their API auth. Jul 7, 2017 at 10:49
  • Client side errors are often caused by browser extensions that users have installed. It may have something to do with that. Jul 7, 2017 at 15:28
  • I'm working through the same problem right now, mine is with a Stripe iframe though so its not specific to Facebook. Also I've only been able to reproduce it on iOS with Chrome. Like @StephenOstermiller said I think it has to do with Chrome's autofill.
    – Ryan Grush
    Jul 7, 2017 at 17:09

2 Answers 2


This was a bug in the iOS autofill implementation: https://bugs.chromium.org/p/chromium/issues/detail?id=709132

The problem in Chrome was fixed, so after updating your browser to the latest available version the errors should disappear.


I have found this issue occures often with the Google Chrome password autofill feature. What seems to be happening is that a Facebook account has had the password saved to Chrome. The reason this may be showing up for you may be if you have any facebook features enabled for your site such as their social plugins chrome may be detecting that facebook is on the page and is attempting to see if there is a password field to prepopulate with the saved password.

I don't believe this is anything to be particularly worried about and it is unlikely to be impacting on client side performance. Your client side bug tracking must be picking up the errors as they are being triggered on a child iframe on your page.

  • This was a bug triggered by the autofill implementation on iOS. It has been fixed. See my answer for my details.
    – fwaechter
    Oct 14, 2017 at 14:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.