- cross-posted to:
- [email protected]
- cross-posted to:
- [email protected]
Fixed: NordPass, ProtonPass, RoboForm, Dashlane, Keeper
Still vulnerable: Bitwarden, 1Password, iCloud Passwords, Enpass, LastPass, LogMeOnce
Key Points
- A new clickjacking technique where a malicious script manipulates UI elements that browser extensions inject into the DOM by making them invisible using javascript.
- In my research, I selected 11 password managers that are used as browser extensions and the result was that all were vulnerable to “DOM-based Extension Clickjacking”. Tens of millions of users could be at risk (~40 million active installations).
- A single click anywhere on the attacker’s website could leak credit card details including security codes (6 out of 9 were vulnerable) or exfiltrate stored personal information (8 out of 10 vulnerable).
- All password managers filled credentials not only to the “main” domain, but also to all subdomains. An attacker could easily find XSS or other vulnerabilities and steal the user’s stored credentials with a single click (10 out of 11), including TOTP (9 out of 11). In some scenarios, passkey authentication could also be exploited (8 out of 11).
- All vulnerabilities were reported in April 2025 with a notice that public disclosure will be in August 2025. Some vendors have still not fixed described vulnerability: Bitwarden, 1Password, iCloud Passwords, Enpass, LastPass, LogMeOnce. Users of these password managers may still be at risk (~32.7 million active installations).
- For Chromium-based browser users it is recommended to configure site access to “on click” in extension settings. This configuration allows users to manually control autofill functionality.
- The described technique is general and I only tested it on 11 password managers. Other DOM-manipulating extensions are probably vulnerable (password managers, crypto wallets, notes etc.).
I know this will be unpopular, but I still don’t use a password manager.
Something about entrusting my passwords to a 3rd party’s software still feels wrong. I’d rather use a passphrase that’s generated per each service based on a set of rules.
You can self host Bitwarden, it’s called Vaultwarden and it’s open source
What about a purely local password manager like keepassxc? It’s foss, you can compile it yourself and never connect to the internet. Or pass even, if you want something more minimal.
I like to use syncthing + keepass. Works really well
I like the idea of compiling locally. I need to look into this.
Thanks!
I don’t think there’s anything wrong with deterministically creating unique and strong pass phrases. It’s just hard to do it in a way that is hard to be both non-obvious (no url in the pass phrase) and also meet all the weird password requirements on the web. Fortunately, max password lengths have generally disappeared. Id love to be able to just use a Sha256 hash everywhere, but some sites require special characters, and some still ban them.
Not disagreeing, you just reminded me of the couple of sites I’ve signed up for that don’t enforce max length on creation, but silently truncate passwords on login. Incredibly frustrating trying to figure out what an acceptable length is through multiple password recoveries.
Feels like putting all the eggs in one basket to me.
You’re not wrong, tbh. I do like the idea of having really complex and random passwords like I see can be generated from password managers.
That said, I would argue that putting all of your passwords (eggs) into one basket (a password manager) would also not be ideal.
Maybe if I used multiple password managers? If one got hacked, maybe the other would be secure?
Maybe if I added a salt to my passwords in a password manager, that would give me the best of both worlds? (I could store most of the password in the manager, then add the salt manually when I need to login. Though I couldn’t use auto-fill anymore.)
A local password manager (e.g. KeePass) will have all your passwords in an encrypted database saved on your machine. You can back up that file however you like. If somehow your machine gets hacked to the level where files can be accessed, the DB file is unusable without the password (the one password you’ll need to remember).