An extensive set of X.org vulnerabilities

Would you mind, if I would attach a key logger to your keyboard? The key logger does not know when you enter a password. Still, the passwords are captured and any human, who gets to see this series of keystrokes can identify them. Even automatic retrieval should give quite good results. Passwords usually look quite different compared to URLs.

Of course, the bigger problem is, that any client can intercept all events. This is a security nightmare. However, the server can do anything, the client can do. Why should attacker code executed in the server context have less privileges than an arbitrary client? All information available to X clients is also available to the server. That this information is usually not used by the server does not mean that introduced attacker code does not use it.