Popular password manager browser extensions are vulnerable to DOM-based clickjacking attacks that can lead to theft of credentials, 2FA codes, and credit card details. Experts recommend disabling auto-fill and manually controlling access until security updates are released. #DOMBasedClickjacking #PasswordManagerVulnerabilities
Keypoints
- 11 popular password manager extensions have been found susceptible to a new type of clickjacking attack.
- The attack manipulates UI elements injected into the DOM to stealthily exfiltrate user data.
- One click on a malicious site could trigger auto-fill and send sensitive information to attackers.
- Six vendors are working on fixes, while users are advised to disable auto-fill functions temporarily.
- The technique can exploit credentials, TOTP codes, and passkey authentication across multiple extensions.
Read More: https://thehackernews.com/2025/08/dom-based-extension-clickjacking.html