Many applications will obtain such a token through an OAuth flow of some kind.
Using a browser-integrated password manager or passkey will usually prevent this attack, though.
Using a browser-integrated password manager or passkey will usually prevent this attack, though.
I think that this is a fairly legitimate attack vector and it's sad because I really want to be able to hide the url bar in my PWAs through custom styling to make it look more like a real native app.