{"id":49699,"date":"2025-10-20T16:51:15","date_gmt":"2025-10-20T20:51:15","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=49699"},"modified":"2025-10-21T15:25:48","modified_gmt":"2025-10-21T19:25:48","slug":"password-manager-browser-extension-clickjacking","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2025\/10\/20\/password-manager-browser-extension-clickjacking\/","title":{"rendered":"Password Manager Browser Extension Clickjacking"},"content":{"rendered":"

Michael Simon<\/a> (via Ric Ford<\/a>):<\/p>\n

If you use Firefox on a Mac or PC, Apple offers a handy browser extension that puts your iCloud passwords right at your fingertips without needing to open a separate app. However, a new warning might make you think twice before you use it next time.<\/p>

As reported by The Hacker News<\/a>, a new Document Object Model vulnerability has been discovered by security researcher Marek Tóth that could allow attackers to steal users’ credit card details, personal data, and login credentials through so-called clickjacking or UI redressing.<\/p>

[…]<\/p>

While some flaws have been patched, several popular password manager<\/a> extensions are at risk, including 1Password, LastPass, and iCloud. With iCloud Passwords, researchers specifically point to version 3.1.25, which Firefox<\/a> uses. Chrome<\/a> uses a newer version, 3.1.27, though it appears as though the flaw still exists.<\/p><\/blockquote>\n\n

Ravie Lakshmanan<\/a>:<\/p>\n

To pull off the attack, all a bad actor has to do is create a fake site with an intrusive pop-up, such as a login screen or a cookie consent banner, while embedding an invisible login form such that clicking on the site to close the pop-up causes the credential information to be auto-filled by the password manager and exfiltrated to a remote server.<\/p>

“All password managers filled credentials not only to the ‘main’ domain, but also to all subdomains,” Tóth explained. “An attacker could easily find XSS or other vulnerabilities and steal the user’s stored credentials with a single click (10 out of 11), including TOTP (9 out of 11). In some scenarios, passkey authentication could also be exploited (8 out of 11).”<\/p><\/blockquote>\n\n

I dislike this whole architecture of integrating password managers via browser extensions. I don’t want the page content to be able to fool the extension, and I don’t like the extension being able to read the page content.<\/p>\n\n

Previously:<\/p>\n