Attackers can exploit invisible elements in these password manager modules, and many of the latter are yet to be patched.
Just when people around the world have just found a suitable password manager to cope with password hygiene, a new security vulnerability has been disclosed affecting widely used password manager browser extensions.
The vulnerability could potentially expose millions of users to credential and data theft.
According to independent researcher Marek Tóth, this is a Document Object Model (DOM)-based extension clickjacking flaw, which targets how browser add-ons handle auto-fill prompts by manipulating UI elements in a way that is invisible to the user.
Clickjacking, also known as UI redressing, tricks people into taking actions they did not intend, such as clicking on harmless-looking buttons that actually perform malicious operations. In this new variant:
- Attackers deploy scripts on malicious web pages to make injected password manager UI components — such as login prompts — fully transparent.
- When a user attempts to interact with benign-seeming elements (such as closing a pop-up), they could unknowingly trigger their password manager to auto-fill credentials on an embedded, invisible form.
- This data, including login credentials, credit card information, and two-factor codes, can then be silently captured and sent to a remote attacker.
Tóth tested 11 major password managers and found that nearly all of them were vulnerable to this technique. In many cases, the password managers auto-filled stored data into forms not only on the main domain but also across all subdomains, which could be further exploited if other site vulnerabilities exist.
According to the findings, 10 out of 11 extensions had allowed DOM-based credential theft; nine had permitted two-factor code exfiltration; and eight were able be manipulated for passkey attacks.
Despite vendors being notified, six affected password managers have yet to release patches. Experts advise users to disable auto-fill in password managers or set browser extension permissions to “on click” for greater control over credential input until comprehensive fixes are deployed.
