Are you refering to this one https://marektoth.com/blog/dom-based-extension-clickjacking?

This doesn't seem to be "passwords on random pages", only "Personal Data + Credit Card,", passwords are domain-specific unless the website is hacked itself.

> The attacker can only steal credentials for the vulnerable domain.

ok that's nice