{"id":141439,"date":"2025-08-24T11:11:56","date_gmt":"2025-08-24T09:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-brauzernye-dopolneniya-s-menedzherami-parolej-ispolzuyushhaya-klikdzheking"},"modified":"2026-01-24T17:56:45","modified_gmt":"2026-01-24T15:56:45","slug":"ataka-na-brauzernye-dopolneniya-s-menedzherami-parolej-ispolzuyushhaya-klikdzheking","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/ataka-na-brauzernye-dopolneniya-s-menedzherami-parolej-ispolzuyushhaya-klikdzheking","title":{"rendered":"Attack on browser extensions with password managers using clickjacking","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
At DEF CON 33, a method of attack on browser extensions was introduced, which inject their interface elements into the viewed page. Applying the attack to extensions with password managers may lead to the leak of information stored in password managers, such as authentication credentials, credit card details, personal data, and one-time passwords for two-factor authentication. This issue affects all tested password managers, including 1Password, Bitwarden, LastPass, KeePassXC-Browser, NordPass, ProtonPass, and Keeper. <\/p>\n
The attack method is based on the fact that browser extensions insert a dialog requesting password autofill directly onto the displayed page, integrating their elements into the DOM (Document Object Model) of that page. If an attacker is able to execute their JavaScript code on the page, for example, by exploiting an XSS vulnerability on the site, they can manipulate all elements in the DOM, including those placed by browser extensions. <\/p>\n
Among other things, it is possible to make the confirmation dialog transparent and spatially align the button in this dialog with a button from a fake dialog created by the attacker to prompt the user to click. Such fake dialogs may include bogus permission requests for cookie access, ad banners, or forms with CAPTCHAs. By placing a spoofed dialog under the transparent password manager dialog and aligning the button locations on the screen, it can be achieved that the user's click will occur on the confirmation button for filling in the authentication parameters in the password manager dialog, even though the user believes they clicked, for example, on a close button for an ad window.
<\/center> <\/p>\n
The attack boils down to the following steps: <\/p>\n
\n
Creating an intrusive element on the page that encourages clicking.\n
Adding a web form to the page for logging in or filling out personal data.\n
Setting transparency for a web form («opacity: 0.001» in CSS).\n
Using the focus() method to set the focus on the input field in the form, leading to the activation of the password manager's autofill dialog.\n
Searching for the newly appeared password manager dialog in the DOM and setting its transparency.\n
Waiting for a user click on a visible intrusive element on the page, which, with a proper combination of visible and invisible elements, will lead to pressing the button in the transparent dialog and filling fields with the password manager.\n
Extracting data from the filled web form and sending it to the attacker's server. <\/ul>\n
As autofill for authentication parameters in the password manager is triggered only for sites where these parameters were saved, to organize an attack, it is necessary to run custom JavaScript code on the attacked site or its subdomain. Therefore, to launch the attack, one must either obtain a subdomain in the same domain as the attacked site or find an XSS vulnerability on the site that allows injecting code into the content displayed to the user. <\/p>\n
It is noted that many users utilize a single password manager for both storing login credentials and generating one-time passwords for two-factor authentication, enabling the described attack method during autofill of one-time passwords. An attack on the site issuetracker.google.com, which contains an XSS vulnerability, is demonstrated as an example. To obtain login credentials and the code for two-factor authentication, it is sufficient to send the user a link exploiting the XSS vulnerability and achieve three clicks through the insertion of fake intrusive requests (cookie processing permission, personalization permission, and acceptance of the privacy policy).
![\"Attack](\"\/wp-content\/uploads\/2025\/08\/9df2f88789928b98278bb49ac8522c38.png\")
<\/center> <\/p>\n