Is Facebook mining passwords from my website?

Question

I just took a look in my bug tracking software and noticed a lot of client-side errors that look like this:

SecurityError SecurityError (DOM Exception 18): Blocked a frame with origin "https://example.com" from accessing a frame with origin "https://staticxx.facebook.com". The frame being accessed set "document.domain" to "facebook.com", but the frame requesting access did not. Both must set "document.domain" to the same value to allow access. 
    https://example.com/path:1:368 hasPasswordField_
    https://example.com/path:1:499 hasPasswordField_
    https://example.com/path:1:173 findPasswordForms
    https://example.com/path:10:27 global code

My website does not have any JavaScript with functions named findPasswordForms or hasPasswordField_. So is a script from Facebook looking at my website’s DOM and trying to find password fields?

Answer 1

This was a bug in the iOS autofill implementation: https://bugs.chromium.org/p/chromium/issues/detail?id=709132

The problem in Chrome was fixed, so after updating your browser to the latest available version the errors should disappear.

Answer 2

I have found this issue occures often with the Google Chrome password autofill feature. What seems to be happening is that a Facebook account has had the password saved to Chrome. The reason this may be showing up for you may be if you have any facebook features enabled for your site such as their social plugins chrome may be detecting that facebook is on the page and is attempting to see if there is a password field to prepopulate with the saved password.

I don't believe this is anything to be particularly worried about and it is unlikely to be impacting on client side performance. Your client side bug tracking must be picking up the errors as they are being triggered on a child iframe on your page.