In HTML when we describe a certain field as a password field is it somehow secured against sending out the data via XHR/AJAX/similar technologies?
This is relevant in case we have to deal with script injection and similar attacks.
According to this question the protection is done on the client-side and only protects against physical viewing of the password, is that correct? It's hard to tell from the lack of information and it is only a blind assumption.
P.S This question has nothing to do with locally stored passwords in the browser.