enter password to unlock screen - the end of the entered password will be written into a browser form if this is the currently active window

Distribution

Linux Mint 21.2 Cinnamon

Package version

5.8.4

Graphics hardware in use

Intel CometLake-H GT2 [UHD Graphics] vendor: Dell driver: i915

Frequency

Quite often

Bug description

If I lock my screen I have to enter the password to unlock it.
When I lock my screen at a state where the Google Chrome browser is the active window (never tried with other browsers) and the current web page in the browser features a form where one can type in text, then (sometimes, not always but quite often) this happens:
after entering the correct password the screen gets unlocked (expected)
and the active form in my browser now contains the last 4 characters of my password (unexpected and very much undesired).
This happens frequently, not always. But any time it happens, then when the active window was a browser with an activated form (my cursor was blinking in the form)

Steps to reproduce

have a browser open as active window with a form on the current page
make sure, that any keyboard stroke would be captured by the form - so that the form is currently really active.
then lock your screen with ctrl-alt-L (so by keyboard shortcut)
Then unlock your screen via typing in your password
Have a look at the form that was active before unlocking the screen: quite frequently it will show the last 4 characters of your password

Expected behavior

when typing in my password to unlock the screen I would expect, that my password is only entered in the unlock screen dialog, none of this data shall be transferred to the active window behind the screen lock.
If one is not careful here you easily ends up sending the last 4 characters of your password to a browser form.

Additional information

No response

No file or test is named. First reproduce with Chrome focused on an editable form, lock with Ctrl-Alt-L, and unlock by typing the password; then trace Cinnamon's screen-lock input and focus handling. Done means password keystrokes remain confined to the unlock dialog and never appear in the previously active form.