It is common that users open HTML page from a downloaded zip file or just an attachment on email.
This page shows how in such case a malicious programmer can access user passwords.
Click Show data to see the collected info.

So Firefox should