Can an application that calls SetWindowsHookEx() capture autocomplete URLs & passwords?

Question

I have an application that uses SetWindowsHookEx() to set a keyboard hook for keystroke logging. This works fine, but in the situation where the web browser is autocompleting a URL or password of course the app doesn't capture the characters that the user doesn't actually type.

My boss found an article that says, "An application that calls SetWindowsHookEx() is capable of capturing even autocomplete passwords." I can't find this documented anywhere. Is it actually possible to get the autocomplete text via hook, and if so how?

Answer 1

I think the article is referring to the fact that the hook runs in the process space of the target. It can scrape screen or memory, it can inject code, it can monitor the event queue.