Firefox Open To New XSS Flaw

1. Create two login forms on domain A. One of them has an action on domain A and the other has an action on domain B.
2. View the first form at domain A and save a username and password.
3. Both forms will now behave the same, except one form is delivering your credentials to the correct party, the other is not.

Actual Results:
Cross-site forms behave identically to same-site forms.

Expected Results:
1. Cross-Site Form Element Warning
2. Cross-Site Password Manager Warning
3. Cross-Site Submit Warning
4. Given all the hype about FF2 anti-phishing technology, one might also expect
some sort of anti-phishing message ;)

FireFox's Password Manager does not check the display property for the elements before filling them in. Therefore an otherwise-normal looking MySpace page could retrieve and populate your myspace U/P fields in hidden fields. Additionally it would probably be possible to use something like { position: absolute; top: -20px; } on your form fields to keep them from showing.