# Zero-Day Clickjacking Vulnerabilities in Major Password Managers

**URL:** https://discuss.privacyguides.net/t/zero-day-clickjacking-vulnerabilities-in-major-password-managers/30278
**Category:** General
**Tags:** software
**Created:** 2025-08-20T19:20:00Z
**Posts:** 76

## Post 1 by @Natha — 2025-08-20T19:20:00Z

Hey y’all :waving_hand:

First post on Privacy Guides. And not a small one.

(If you saw my first attempt, I may have triggered the spam filter by mistake - mods, you can delete my first hidden thread)

## Long story short: if you’re using a password manager with a browser extension, your data might (have) be(en) at risk.

A security vulnerability has been discovered in many popular password managers, including 1Password, Bitwarden, Dashlane, EnPass, iCloud Passwords, Keeper, LastPass, LogMeOnce, NordPass, Proton Pass and Roboform.

If you’re using Dashlane, Keeper, NordPass, Proton Pass or Roboform, make sure to be on the latest version available. They have already release updates of their apps and extensions to fix the issue.

If you’re using Bitwarden, an update (2025.8.0) is coming later this week.

If you’re using iCloud Passwords or EnPass, both have been partially fixed but are still vulnerable today. iCloud Passwords received a better fix than EnPass.

Finally, and that is the annoying news of the day: if you’re using 1Password, LastPass or LogMeOnce, you are definitely at risk. The third one simply didn’t answer the security researcher emails. And both 1Password & Last Pass have purely and simply decided to not do anything about it. More about that down below.

For now, there are three things that you can do right away to mitigate the risks:

- Deactivate the autofill in your extension settings

- Make sure that the setting making sure that only an exact URL match will allow autofill credentials (Watchout tho as this won’t work for your credit cards and personal data.)

- For Chrome and Chromium-based browsers, change your extension settings by right clicking on the extension → Manage Extension → Site Access → On click

What this will do is to make sure that your extension is only active if you click beforehand on its icon. Which leads me to the other main important point of this security vulnerability: you are at risk only when your vault is unlocked. If your vault is password/biometric locked and you end up on a compromise website, you will be safe. If your vault is unlocked, you won’t be safe.

Going back to 1Password and LastPass… What is their reason not to implement a fix for this?

For them, this is just another case of clickjacking. A form of hacking that they do consider out of their security scope. To quote from the 1Password website:

> Techniques like clickjacking or deceptive overlays can be used to trick users into interacting with interface elements, including autofill prompts, in ways that may expose sensitive information.
> 
> Your information in 1Password is always encrypted and protected. Clickjacking does not expose all your 1Password data or export all your vault contents, and no website can directly access your information without interaction with the browser extension’s autofill element. At most, a malicious or compromised webpage could trick you into autofilling a single matching item following a click, not everything in your account.
> 
> For maximum safety, consider locking the 1Password browser extension when browsing unfamiliar or risky sites so autofill requires explicit intent.

The thing is that this vulnerability, relying on clickjacking (but not only), has been fixed by many other password managers like Proton, NordPass, Dashlane, etc.

This means that this specific issue is fixable. And both 1Password and LastPass have concluded that it was not critical enough to fix. I’ll let you be the judge on this, but as a long time 1Password customer, I feel betrayed and outraged by how they are dealing with this.

To quote them again, from the [first article](https://socket.dev/blog/password-manager-clickjacking) I came across spotlighting the breach discovery:

> Security and usability are a balance, one that we are always making tradeoffs back and forth to find the right solution. Sometimes there is no perfect solution, only the solution that works best for the most users. As I mentioned previously, it is only with user feedback that we chose to remove the prompt for the PII items that would prevent clickjacking from occurring. A change that we’ve documented in the support article under the "Identity alerts” section.

Meaning that what works best for their users is (in an oversimplified way) to make sure that they won’t have to deal with an alert message in this case. Alas, the only kind of item that is deemed to still be “safe” in 1Password (credit cards) do involve an alert message that isn’t even correctly labeled.

To end with the conclusion quote of the researcher (and assuming it does fit your threat model):

> 2FA should be strictly separated from login credentials - when storing everything in one place, so the attacker could exploit vulnerable password managers and gain access to the account even with 2FA enabled.

tl;dr:

> **Clickjacking is not dead** - browser extensions are vulnerable to clickjacking  
> → iframe-based and especially to the DOM-based
> 
> **Malicious script can be on any trusted website (XSS, subdomain takeover, web cache poisoning…).**  
> XSS is not RCE, attackers can find (easily) this vulnerability.  
> :warning: 1 click = attacker gets your credentials incl. TOTP (only for vulnerable domain)
> 
> **No vulnerability is needed to leak your credit card, personal data**  
> :warning: 1 click = credit cards details or personal data (attacker’s website)  
> :warning: 2 clicks = credit cards details + personal data (attacker’s website)
> 
> **Fixed** : NordPass, ProtonPass, RoboForm, Dashlane, Keeper  
> **Still vulnerable** : Bitwarden, 1Password, iCloud Passwords, Enpass, LastPass, LogMeOnce
> 
> **Research on only 11 password managers**  
> others DOM-manipulating extensions will be vulnerable (password managers, crypto wallets, notes etc. )

Finally, and assuming that it does fit your threat model:

> 2FA should be strictly separated from login credentials - when storing everything in one place, so the attacker could exploit vulnerable password managers and gain access to the account even with 2FA enabled.

So, yeah. Be safe out there. No system is ever 100% safe.

> **[DOM-based Extension Clickjacking: Your Password Manager Data at Risk](https://marektoth.com/blog/dom-based-extension-clickjacking/)**
>
> I described a new attack technique that I used against 11 password managers. The result was that stored data of tens of millions of users could be at risk.

---

## Post 2 by @Natha — 2025-08-20T20:38:17Z

FYI: Bitwarden have released their update to fix the issue. If your browser extension is the version 2025.8.0, you’re good to go.

---

## Post 3 by @Catalyst2422 — 2025-08-20T21:15:40Z

Forgive me if I’m wrong. But has it not previously been recommended on PG that Auto-fill should be disabled in browser based password managers?

It could have been elsewhere that I saw the recommendation. But it made perfect sense to me when I first read about it and would prevent this vulnerability.

---

## Post 4 by @Natha — 2025-08-20T21:46:50Z

This case is a pretty good example of autofill being exploited for malicious purposes. I don’t remember reading anything in the knowledge base that was mentioning autofill as an option to avoid/turn off. But it is common knowledge that anything (semi-)automatically inputting data for you may eventually become a security issue in the long run.

Here, whoever was manually copy pasting their logins and password from their password managers to the web browser were not impacted by this vulnerability. Same thing for anyone who was relying on an external 2FA (in a dedicated app, not in your password managers, or with a FIDO hardware key)

---

## Post 5 by @anon57862721 — 2025-08-21T07:54:55Z

Relevant video:

> **[most major password managers vulnerable to 0-day clickjacking attack](https://www.youtube.com/watch?v=x5-sFQnSj0s)**
>
> Subscribe to my free weekly newsletter: https://vulnu.com/subscribeMajor Password Managers Exposed: New Clickjacking Vulnerability!Researchers uncovered zero...

---

## Post 6 by @IksNorTen — 2025-08-21T08:57:30Z

Serious 1Password flaw? Allegedly. Please let’s focus on what matters: polished **UX** and a **stress-free** setup.

Priorities folks. If the fan club insists the **UX** is divine, who are we to ask for security?

And thank heavens nobody’s been asking for years to remove 1Password from our recommended list :folded_hands:

---

## Post 7 by @123 — 2025-08-21T09:14:42Z

KeePassXC extension not mentioned…

---

## Post 8 by @anon57862721 — 2025-08-21T09:18:22Z

Because it doesn’t autofill

---

## Post 9 by @anon37002130 — 2025-08-21T10:37:46Z

> Link to where this is said here:
> 
> [https://socket.dev/blog/password-manager-clickjacking#:~:text=It’s%20the%20opinion%20of%20the%20Socket%20Security%20Team%20that%2C%20if%20this%20is%20the%20case%2C%20the%20mitigations%20currently%20implemented%20by%20other%20password%20managers%20may%20also%20be%20bypassable](https://socket.dev/blog/password-manager-clickjacking#:~:text=It%E2%80%99s%20the%20opinion%20of%20the%20Socket%20Security%20Team%20that%2C%20if%20this%20is%20the%20case%2C%20the%20mitigations%20currently%20implemented%20by%20other%20password%20managers%20may%20also%20be%20bypassable)
> 
> ## **Discussion with 1Password[#](https://socket.dev/blog/password-manager-clickjacking#Discussion-with-1Password)**
> 
> After filing the request for CVE numbers with US-CERT the Socket Security Team reached out to the impacted password manager vendors to alert them about the pending CVE assignment. At time of publication, only 1Password responded.
> 
> On a call between the 1Password and Socket Security Team, 1Password explained that the mitigations proposed by Tóth could be trivially bypassed, and that the only way to mitigate the vulnerabilities fully would be to implement a dialog popup to prompt the user before autofilling. It’s the opinion of the Socket Security Team that, if this is the case, the mitigations currently implemented by other password managers may also be bypassable.
> 
> 1Password stated they considered this dialogue popup solution, and implemented it for credit card fields, but opted-not to implement this for PII due to user feedback, according to the H1 triage logs with Tóth:
> 
> > **Security and usability are a balance, one that we are always making tradeoffs back and forth to find the right solution. Sometimes there is no perfect solution, only the solution that works best for the most users. As I mentioned previously, it is only with user feedback that we chose to remove the prompt for the PII items that would prevent clickjacking from occurring. A change that we’ve documented in the support article under the "Identity alerts” section.**
> 
> As of the time of publication, 1Password has chosen not to provide an official statement to the Socket Security Research team about Tóth’s research.
> 
> While it is easy to assume vendors are simply ignoring these vulnerabilities, the reality is more complicated. Mitigating DOM-based clickjacking in a way that is both robust and frictionless for end users is a technically difficult challenge. The most straightforward solution, adding confirmation dialogs before autofilling, does introduce usability friction that some users may push back on. Password managers walk a tightrope between security and usability, and choices about which safeguards to enforce ultimately reflect product decisions about that balance. That said, the research highlights that what’s convenient for users in the short term can leave them exposed to systemic risks that attackers may exploit.

---

## Post 10 by @KevPham — 2025-08-21T13:47:43Z

I’m sure the vast majority of 1Passwords’s clients are folks who would otherwise use something like “password123” at the slightest annoyance. Not excusing that fact 1Password is basically doing nothing though, even a simple fix that is somewhat bypassable is better than nothing.

---

## Post 11 by @anon57862721 — 2025-08-21T13:49:40Z

> [@KevPham](#):
>
> Not excusing that fact 1Password is basically doing nothing though, even a simple fix that is somewhat bypassable is better than nothing.

The video I posted a few comments above explains this..

---

## Post 12 by @bluegasf — 2025-08-21T14:27:49Z

what about KeepassXC + Brave + KeepassXC-extension?

---

## Post 13 by @anon57862721 — 2025-08-21T14:29:16Z

As I understand it, this issue only affects those who autofill KeePass is safe.

But you may want to watch that video to understand it if all the other info sounds too esoteric.

---

## Post 14 by @anon11657877 — 2025-08-21T14:43:28Z

> [@IksNorTen](#):
>
> Please let’s focus on what matters: polished **UX** and a **stress-free** setup.

So you think security and privacy don’t matter?

> [@IksNorTen](#):
>
> And thank heavens nobody’s been asking for years to remove 1Password from our recommended list :folded_hands:

> [@Remove 1Password](https://discuss.privacyguides.net/t/remove-1password/13921):
>
> 1Password embeds tracking pixels in its newsletters. You can subscribe to their newsletter through their website. The tracking pixel should be included in your subscription confirmation email.

---

## Post 15 by @IksNorTen — 2025-08-21T14:59:46Z

Come on it was sarcasm :joy:

---

## Post 16 by @anon37002130 — 2025-08-21T15:22:37Z

There is a fix it is in settings:

 ![IMG_20250821_112209_069](https://forum-uploads.privacyguidesusercontent.com/original/2X/2/2196ae09e249bf57123e230613675a110404e7dc.jpeg)

> “The most straightforward solution, adding confirmation dialogs before autofilling, does introduce usability friction that some users may push back on. Password managers walk a tightrope between security and usability, and choices about which safeguards to enforce ultimately reflect product decisions about that balance. That said, the research highlights that what’s convenient for users in the short term can leave them exposed to systemic risks that attackers may exploit.”  
> [https://socket.dev/blog/password-manager-clickjacking#:~:text=The%20most%20straightforward,attackers%20may%20exploit](https://socket.dev/blog/password-manager-clickjacking#:~:text=The%20most%20straightforward,attackers%20may%20exploit).

It is just not on by default.

---

## Post 18 by @PurpleDime — 2025-08-21T15:44:24Z

> [@Natha](#):
>
> Here, whoever was manually copy pasting their logins and password from their password managers to the web browser were not impacted by this vulnerability.

**Doesn’t copy and pasting ones credentials presents its own risks?**

You constantly have to manually verify that you are on the correct URL.

As a 1Password user, I am disappointed that they are refusing to do something about this issue, even if the solution is not full proof.

_ **1Password getting worse** _

Before 1Password, I was a long time user of LastPass, and a feature that I loved in LastPass is auto-login. That’s when your password manager automatically logs you into a website without you having to manually click _autofill_ and _login._

When I switched to 1Password, I was very disappointed that they didn’t have this feature and asked them why. They had pointed me to a blog post on their website, explaining that auto-login presents a security risk. Even though it was a little annoying, their reasoning made sense to me, and I got used to having to manually autofill my credentials.

Fast-forward to I wanna say earlier this year or late last year, and 1Password introduces auto-login as a feature, and on top of that makes it the default setting. They reversed their position on something they were staunchly against for a long time, and this surprised me. I can no longer find the blog post where they explain why they were against auto-login.

Moreover, 1Password 8, which was launched 3 years ago, has introduced a lot of bugs that they are in no hurry to fix, which is extremely frustrating

_ **UI & UX vs Security** _

IMHO, 1Password has the best UI and UX of any password manager (except on Android, where UX sucks). Obviously, UI & UX aren’t everything, but it’s why I still use it. That said, I always hoped that I would eventually be able to switch to Proton Pass for which I have a paid subscription, but they are still quite far from being there in terms of UI & UX for me. More than a third of my 1Password credentials are not importable in Proton Pass. And they lack a lot of features I need.

I understand that there is a real balance between UI & UX vs security, but IMO, it doesn’t apply to everything. I think any password manager can have both, especially when they are a successful company like 1Password or Proton.

---

## Post 19 by @anon37002130 — 2025-08-21T15:45:24Z

> [@PurpleDime](#):
>
> As a 1Password user, I am disappointed that they are refusing to do something about this issue, even if the solution is not full proof.

Look above your comment you can enable the fix yourself in the extension’s security settings.

---

## Post 24 by @KevPham — 2025-08-21T16:02:57Z

Hey folks. Lets keep the conversation respectful regardless of your opinion on 1Password.

---

## Post 25 by @Natha — 2025-08-22T00:29:00Z

Update regarding the vulnerability state of the 11 password managers mentioned.

tl;dr: Only LogmeOnce is still fully vulnerable. 1Password released a first fix and blog post/statement (a second fix is on the way). LastPass won’t do more (if you’re still using LastPass…). Every other password managers mentioned released a fix and communicated with their users about it.

> **:orange_circle: 1Password**  
> **Vulnerable version:** \<8.11.7.2  
> **Partially fixed:** 8.11.7  
> **Improvement:** You can now choose to have 1Password ask before it autofills logins, credit cards, or other non-credential items in your browser. You can turn on “Ask before filling” for certain items under Settings \> Security. Please see the accompanying [security advisory](https://support.1password.com/kb/202508).  
> **Vulnerable methods:** Parent Element, Overlay In addition to the clickjacking vulnerability, **1Password has confusing texting in the dialog box** when filling in a credit card. There is generic text “item”. The user may not know that it is a credit card.  
> **Upcoming fix:** [8.11.7.2](http://8.11.7.2) (check the blog post for the details)

> **:green_circle: Bitwarden**  
> **Vulnerable version:** 2025.7.0 \*\*Fixed: 2025.8.0 **Vulnerable methods:** Parent Element

> **:green_circle: Dashlane**  
> **Fixed:** v6.2531.1 (1.8.2025)  
> **Security Overview:** [https://support.dashlane.com/hc/en-us/articles/28598967624722-Advisory-Passkey-Dialog-Clickjacking-Issue](https://support.dashlane.com/hc/en-us/articles/28598967624722-Advisory-Passkey-Dialog-Clickjacking-Issue)

> **:orange_circle: Enpass**  
> **Vulnerable version:** 6.11.6 (latest) **Vulnerable methods:** Parent Element, Overlay  
> **Fixed Method:** Extension Element \<6.11.4.2 (19.5.2025)  
> **Release Notes:** [https://www.enpass.io/release-notes/enpass-browser-extensions/](https://www.enpass.io/release-notes/enpass-browser-extensions/)

> **:orange_circle: iCloud Passwords**  
> **Vulnerable version:** 3.1.25 (latest) / _Note from commenter: partially fixed, no other infos from Apple at this time_  
> **Methods:** Overlay  
> **Fixed Method:** Extension Element \<2.3.22 (12.8.2024)  
> **Acknowledgements:** August 2024 [https://support.apple.com/en-us/122162](https://support.apple.com/en-us/122162)

> **:green_circle: Keeper**  
> **Fixed Methods:**  
> Extension Element \<17.1.1 (1.5.2025)  
> Overlay \<17.2.0 (29.7.2025)

> **:orange_circle: :cross_mark: LastPass**  
> **Vulnerable version:** 4.146.1 (latest)  
> **Vulnerable methods:** Parent Element, Overlay  
> **Fixed:** Credit Card, Personal Data \<=4.125.0 (15.12.2023) / _Note from commenter: partially fixed, won’t make further change._

> **:red_circle: LogMeOnce**  
> **Vulnerable version:** 7.12.4 (latest)  
> **Vulnerable methods:** Extension Element, Parent Element, Overlay

> **:green_circle: NordPass**  
> **Fixed:** \<5.13.24 (15.2.2024)

> **:green_circle: ProtonPass**  
> **Fixed Methods:**  
> Extension Element, Parent Element \<1.9.5 (22.12.2023)  
> Extension Element \<=1.31.0 ([CRX](https://marektoth.com/files/ghmbeldphafepmbegfdlkpapadhbakde_1_31_0.crx))  
> Overlay \<=1.31.4  
> **Acknowledgements:** [https://proton.me/blog/protonmail-security-contributors](https://proton.me/blog/protonmail-security-contributors)

> **:green_circle: RoboForm**  
> **Fixed Methods:**  
> Extension Element \<9.5.6 (7.12.2023)  
> Parent Element, Overlay \<9.7.6 (25.7.2024)  
> **Release Notes:** [https://www.roboform.com/news-ext-chrome](https://www.roboform.com/news-ext-chrome)

Long story short: only web extensions are impacted. Desktop and mobile apps are safe. If you’re using a web browser extension, make sure to turn off autofill until a fix is released. If you’re using a Chromium web browser, you can also change the “Site access” setting of your password manager extension to “On click”.

If it wasn’t the case already (assuming that your threat model requires it):

> 2FA should be strictly separated from login credentials - when storing everything in one place, so the attacker could exploit vulnerable password managers and gain access to the account even with 2FA enabled.

---

## Post 26 by @Natha — 2025-08-22T00:34:30Z

> Serious 1Password flaw? Allegedly. Please let’s focus on what matters: polished **UX** and a **stress-free** setup.
> 
> Priorities folks. If the fan club insists the **UX** is divine, who are we to ask for security?

UI is as important as UX. Not every user is tech-savvy. Having a good UI can be the argument that makes the difference between using a password manager, or not using one at all. As long as you don’t go for LastPass… It is 100% better and safer to use a password manager. And it doesn’t matter if it’s in the case of a common person or not.

---

## Post 27 by @Natha — 2025-08-22T00:38:36Z

> [@123](#):
>
> KeePassXC extension not mentioned…

Compared to the other password managers, KeePass works differently. The way the app communicates with the extension is much safer. Compared to the other ones, some of their extensions are an autonomous password manager in itself. One that is embedded in the user browser.

---

## Post 28 by @anon83428815 — 2025-08-22T04:20:41Z

@Natha great update thanks!

> [@Natha](#):
>
> UI is as important as UX. Not every user is tech-savvy. Having a good UI can be the argument that make sthe difference between using a password manager, or not using one at all

I think this is a valid insight that users who are more privacy focused tend to forget. For a lot of people using a password manager is a huge change and one of the biggest steps a person can make in their privacy journey.

---

## Post 29 by @Natha — 2025-08-23T18:33:15Z

**Important update: 24/08/2025 5h15 GMT+1**

- Added :red_circle: **KeePassXC-Browser** is **vulnerable** : please see the update original article [here](https://marektoth.com/blog/dom-based-extension-clickjacking/#keepassxc-browser)
- Updated :red_circle: **Bitwarden** status, **latest** version **(2025.8.1) still vulnerable** (No ETA for the next update)
  - A **fix** for the **overlay vulnerability is** **[in the work](https://github.com/keepassxreboot/keepassxc-browser/issues/1367#issuecomment-3213464104)**

- Changed :orange_circle: **1Password** to :red_circle: (the vulnerability also concerns your credit card info, please check the details)
- Changed :orange_circle: **iCloud Password** to :red_circle: (the overlay vulnerability is the most likely to be exploited on naive users)
- Added links to screen recordings for each vulnerable password manager, showing the exploit in action

For now, **make sure to turn off auto fill**. If you’re using a Chromium web browser, you can also change the “Site access” setting of your password manager extension to “On click”.

And this is, once again, a good reminder to keep your 2FA/TOTP separated from your main device.

The complete changelog:

**:red_circle: VULNERABLE :warning:**

> **:red_circle: 1Password**  
> **Vulnerable version:** \<= **8.11.7.2** ( **latest** )  
> **Vulnerable methods** : Parent Element, Overlay Videos  
> **Videos:** [opacity:0](https://websecurity.dev/video/1password.mp4) [opacity:0.5](https://websecurity.dev/video/1password-visible.mp4)

> In addition to the clickjacking vulnerability, **1Password has confusing texting in the dialog box when filling in a credit card.** There is generic text “ **item** ”. **The user may not know that it is a credit card.**

> [https://websecurity.dev/video/1password\_personaldata\_creditcard.mp4](https://websecurity.dev/video/1password_personaldata_creditcard.mp4)

> **Improvement** in **8.11.7.2:** You can now choose to have 1Password ask before it autofills logins, credit cards, or other non-credential items in your browser. You can turn on “Ask before filling” for certain items under Settings \> Security. Please see the accompanying [security advisory](https://support.1password.com/kb/202508).

> **:warning: Note: it is really advised to turn this setting on and deactivate auto fill. :warning:**

> **:red_circle: Bitwarden**  
> **Vulnerable version:** \<= **2025.8.1** ( **latest** )  
> **Vulnerable methods:** Overlay  
> **Videos:** [opacity:0 + opacity:0.5](https://websecurity.dev/video/bitwarden2.mp4)

> :red_circle: **iCloud Passwords**  
> **Vulnerable version:** 3.1.25 ( **latest** )  
> **Methods:** Overlay  
> **Videos:** [opacity:0](https://websecurity.dev/video/icloudpassword.mp4) [opacity:0.5](https://websecurity.dev/video/icloudpassword-visible.mp4) **Acknowledgements:** August 2024 [https://support.apple.com/en-us/122162](https://support.apple.com/en-us/122162)  
> **Fixed:** Extension Element \<2.3.22 (12.8.2024)

> :red_circle: **KeePassXC-Browser**  
> **Vulnerable releases:** \<=1.9.9.2 ( **latest** )  
> **Vulnerable methods:** Extension Element, Overlay  
> **Videos:** [opacity:0 + opacity:0.5](https://websecurity.dev/video/keepassxc1992.mp4) (1.9.9.2) / [as seen](https://websecurity.dev/video/keepassxc.mp4) in 1.9.9.1

> :red_circle: **LastPass**  
> **Vulnerable releases:** 4.146.1 ( **latest** )  
> **Vulnerable methods:** Extension Element, Parent Element, Overlay  
> **Videos:** [opacity:0](https://websecurity.dev/video/lastpass.mp4) [opacity:0.5](https://websecurity.dev/video/lastpass-visible.mp4)  
> **Fixed** : Credit Card, Personal Data \<=4.125.0 (15.12.2023) / _Note from commenter: no further update ahead, assume that it_ _ **won’t** _ _be fixed._

> **:red_circle: LogMeOnce**  
> **Vulnerable releases:** 7.12.4 ( **latest** )  
> **Vulnerable methods:** Extension Element, Parent Element, Overlay  
> **Videos:** [opacity:0](https://websecurity.dev/video/logmeonce.mp4) [opacity:0.5](https://websecurity.dev/video/logmeonce-visible.mp4)

**:green_circle: FIXED**

> **:green_circle: Dashlane**  
> **Fixed:**  **v6.2531.1** (1.8.2025)  
> **Security Overview:** [https://support.dashlane.com/hc/en-us/articles/28598967624722-Advisory-Passkey-Dialog-Clickjacking-Issue](https://support.dashlane.com/hc/en-us/articles/28598967624722-Advisory-Passkey-Dialog-Clickjacking-Issue)

> **:green_circle: Enpass**  
> **Vulnerable version: 6.11.6** ( **latest** )  
> **Release Notes:** [https://www.enpass.io/release-notes/enpass-browser-extensions/](https://www.enpass.io/release-notes/enpass-browser-extensions/)  
> **Vulnerable:**  
> Parent Element, Overlay (\<= 6.11.5)  
> Extension Element (\<6.11.4.2)  
> **Fixed Method:** Extension Element \<6.11.4.2 (19.5.2025)

> **:green_circle: Keeper**  
> **Fixed:**  **17.2.0**  
> **Vulnerable releases:**  
> Extension Element \<17.1.2 (26.5.2025)  
> Overlay \<17.2.0 (25.7.2025)\*\*

> **:green_circle: NordPass**  
> **Fixed:** 5.13.24 (15.2.2024)

> **:green_circle: Proton Pass**  
> **Fixed:**  **1.31.6**  
> **Acknowledgements:** [https://proton.me/blog/protonmail-security-contributorsExtension](https://proton.me/blog/protonmail-security-contributorsExtension)  
> **Vulnerable releases** :  
> Element, Parent Element \<1.9.5 (22.12.2023)  
> Extension Element \<=1.31.0 ([CRX](https://marektoth.com/files/ghmbeldphafepmbegfdlkpapadhbakde_1_31_0.crx))  
> Overlay \<=1.31.4

> **:green_circle: RoboForm**  
> **Fixed:**  **=\<9.7.6** (25.7.2024)  
> **Release Notes:** [https://www.roboform.com/news-ext-chrome](https://www.roboform.com/news-ext-chrome)  
> **Vulnerable releases** :  
> Extension Element \<9.5.6 (7.12.2023)  
> Parent Element, Overlay \<=9.7.5 (25.7.2024)

tl;dr: **only web extensions are impacted.**  
Desktop and mobile apps are safe. **Turn off autofill until a fix is released.**

Finally, if it wasn’t the case already (assuming that your threat model requires it):

> 2FA should be strictly separated from login credentials - when storing everything in one place, so the attacker could exploit vulnerable password managers and gain access to the account even with 2FA enabled.

---

## Post 30 by @anon57862721 — 2025-08-23T18:36:48Z

Thanks for the detailed update!

---

## Post 31 by @paulrudy — 2025-08-23T23:47:41Z

> [@Natha](#):
>
> tl;dr: **only web extensions are impacted.**  
> Desktop and mobile apps are safe. **Turn off autofill until a fix is released.**

Thanks for all of this info. So it sounds like the desktop apps advice would also apply to Keepassium, which does not have a browser extension, but integrates with MacOS’s autofill (e.g. in Safari). i.e., Keepassium users should disable that autofill integration and manually copy/paste, correct?

Curious also if the same would apply to iOS. Sounds like there’s no reason it wouldn’t

---

## Post 32 by @moonwriting — 2025-08-24T01:18:00Z

Someone on the Bitwarden community forums also [suggested](https://community.bitwarden.com/t/should-i-be-worried-about-clickjacking/87988/2) that using alternative autofill methods, such as [the keyboard shortcut](https://bitwarden.com/help/auto-fill-browser/#keyboard-shortcuts) could eliminate this issue since it’s only related to [inline autofill](https://bitwarden.com/help/auto-fill-browser/#inline-autofill-menu), which is the way most password managers handle autofill. Can someone confirm this?

---

## Post 33 by @Natha — 2025-08-24T03:59:32Z

Post updated: the fix released by Bitwarden (2025.8.1) didn’t fix the vulnerability.

No ETA for the fix of the fix. :roller_coaster:

KeePass is [working](https://github.com/keepassxreboot/keepassxc-browser/issues/1367#issuecomment-3213464104) on a fix (the following was wrong: _and [confirmed](https://github.com/keepassxreboot/keepassxc-browser/issues/1367#issuecomment-3215046283) that using the default settings will keep you safe._)

LogmeOnce did log an update on their [website](https://support.logmeonce.com/hc/en-us/articles/360049503673-Release-Notes-for-7-x), but still no sign of it on the Chrome Web Store. Will update as soon as it is available.

Finally, LastPass still doesn’t care. :man_shrugging:

---

## Post 34 by @asanyan — 2025-08-24T04:28:13Z

This is why PG should recommend local app + autotype functionality. Not the first time and certainly won’t be the last.

---

## Post 35 by @Natha — 2025-08-24T04:34:28Z

There used to be a time, not that long ago, when 1Password was developing a real native macOS app with a global, application agnostic auto fill. One that was semi-automatic/user dependent, as you needed to click at least once to fill something in. It was fast, butter smooth, reliable, safe (thanks to the macOS sandboxing). That got killed when 1Password 8 was released, starting the Electron-era for each and every version of the app. And we all know how annoying an app may become when its developper(s) decide(s) to go the Electron way.

So, yeah. Local apps did make a difference, and still do today.

---

## Post 36 by @asanyan — 2025-08-24T04:54:09Z

Even without per-URL autofill, password management can be made very convenient with local apps at least on linux. The way I have it set up is just: press super+S → start typing name of service (password manager entries have to be descriptive) → press enter → focus on input box (if it doesn’t autofocus) and wait 2 seconds for autotype. Press enter again to login. Takes less than 5 seconds total.

---

## Post 37 by @anonymous378 — 2025-08-24T05:01:31Z

> [@Natha](#):
>
> Bitwarden (2025.8.1) didn’t fix the vulnerability.

That’s a bummer! Have any of the other password manager fixes been confirmed to work?

---

## Post 38 by @anon57862721 — 2025-08-24T05:02:06Z

Read the updates above.

---

## Post 39 by @anonymous378 — 2025-08-24T05:04:09Z

Maybe I missed something? Keepass being confirmed is nice but that was already expected. I meant managers who were actually thought to be affected. Such as Proton or Dashlane who also have fixes out that were released around when Bitwardens was.

---

## Post 40 by @anon57862721 — 2025-08-24T05:09:07Z

I mean, they have had fixes. Confirmation from the community for whether it actually and truly fixes the issue is not yet available I think.

But I have no reason to doubt it hasn’t. I atleast have that much trust with the people behind Proton and a couple others.

---

## Post 41 by @anonymous378 — 2025-08-24T05:11:47Z

> [@anon57862721](#):
>
> But I have no reason to doubt it hasn’t

Sure, I think most people would of said that about Bitwarden.

I probably would not have even thought to wait for the fixes to be confirmed working, without that coming out.

With 1Password basically questioning if it can be fixed (maybe better to say if its worth it) and then Bitwarden having their fix fail, makes it more interesting then I’d have expected.

---

## Post 42 by @anon57862721 — 2025-08-24T05:13:09Z

Bitwarden here with this situation appears to be an outlier and uncharacteristically so. Not sure what’s going on with them.

---

## Post 43 by @anon57862721 — 2025-08-24T05:16:12Z

With 1Password, they do have their reasons for it. There’s a video I posted earlier in this thread that explains it.

---

## Post 44 by @anonymous378 — 2025-08-24T05:21:46Z

Yeah I saw their statement. Can’t say I’d feel super confident if I’m a 1Password user and they have to throw out “Security and usability are a balance” as a response to a security issue.

---

## Post 45 by @anon57862721 — 2025-08-24T05:50:52Z

I mean, what they said is not wrong from a factual POV but yeah, for a security first product its not good.

---

## Post 46 by @kxd — 2025-08-24T14:37:01Z

am I missing something? for bitwarden / firefox:

- [release notes in github](https://github.com/bitwarden/clients/releases) doesn’t show anything relevant for this clickjacking
- [bitwarden on firefox store](https://addons.mozilla.org/en-US/firefox/addon/bitwarden-password-manager/) is on a much older

bummer :confused:

---

## Post 47 by @Natha — 2025-08-24T17:23:21Z

> [@kxd](#):
>
> am I missing something? for bitwarden / firefox

Alas, you’re not missing anything. Bitwarden is still not patched, and the recent updates might not have been made available everywhere. Extensions are usually not updated simultaneously on every platform. Google, Firefox and Apple don’t have the same process and delays to verify/approve/make an update available.

> [@anonymous378](#):
>
> Maybe I missed something? Keepass being confirmed is nice but that was already expected. I meant managers who were actually thought to be affected.

KeePass is **not** safe. An update is in the work as we speak. But there was a bit of drama between the devs and the security researcher on KeePass GitHub… : [Clickjacking vulnerability · Issue #1367 · keepassxreboot/keepassxc-browser · GitHub](https://github.com/keepassxreboot/keepassxc-browser/issues/1367)

Again, I’ll let you be the judge. My comment over there (which is the last one before the thread got locked) summarise what I think about this whole mess. And even tho KeePass is open source (with volunteer devs behind it, like any open source project), I really don’t get the general minimisation of these vulnerabilities. Besides the devs behind the apps that got patched first (Dashlane, Keeper, NordPass, Proton and RoboForm), everyone else (including the big ones like 1Password) went with the patronising approach towards their users. A drama about a security issue minimised by password managers developers… None of this really makes sense. But eh. As long as things are getting fixed, minimising the security risks, that’s what matters.

It could be nice tho to give a break to the security researcher who found these vulnerabilities. I feel bad for him, working all night long, providing unquestionable proofs, just to get told to stop spreading false informations by the developers at play. I mes c what the hell. The goal is to improve everyone’s safety online. Why blaming the messenger, besides not assuming their mistakes? :exploding_head:

---

## Post 48 by @Natha — 2025-08-24T17:30:59Z

FYI: the default KeePass settings **do not** protect you from the vulnerability.

Proof of work made by the security researcher: [https://youtu.be/Mx0YWLH6pYA](https://youtu.be/Mx0YWLH6pYA)

And his comment on KeePass GitHub (be aware, it’s a lengthy one and part of a drama): [Clickjacking vulnerability · Issue #1367 · keepassxreboot/keepassxc-browser · GitHub](https://github.com/keepassxreboot/keepassxc-browser/issues/1367#issuecomment-3217885523)

---

## Post 49 by @NovaViper — 2025-08-24T19:16:49Z

@Natha :eyes: Should I completely switch from KeePassXC to something like GNU pass since it appears they don’t plan to fix the issue in any capacity?

---

## Post 50 by @Natha — 2025-08-24T19:25:15Z

If you’re talking about this [Pass](https://www.passwordstore.org/), I’ve seen the name many times in several devs communities over the past few days. I think it can be trusted, but I’ve never tried/used it. Maybe someone else who’s been using it can give us a bit more of details

---

## Post 51 by @Natha — 2025-08-24T19:34:43Z

I mean, here’s the original guy repository: [https://git.zx2c4.com/password-store/about/](https://git.zx2c4.com/password-store/about/)

And the dev website: [https://www.zx2c4.com](https://www.zx2c4.com)

Who is the creator of WireGuard. I would definitely trust this guy and his work.

---

## Post 52 by @NovaViper — 2025-08-24T20:22:59Z

There was a time I did use Pass a long long time ago, but I stopped using it because it was inconvenient to use when I was on iOS. Maybe it’s easier on Android :thinking:

Edit:  
Ah… looks like there aren’t any Android apps for Pass anymore :pensive_face:

---

## Post 53 by @IksNorTen — 2025-08-25T07:33:29Z

The vulnerability only concern KeePassXC with extensions, you’re perfectly fine without these

---

## Post 54 by @NovaViper — 2025-08-25T10:17:49Z

Thats just the thing, I’ve been using the extension for a long time and is one of the main ways i use the password manager as the global type feature works sparingly on Linux. Seeing that the developers not only not _ **at least** _ try to address but _ **minimize** _ the severity of the issue is a big turn off.

---

## Post 55 by @IksNorTen — 2025-08-25T10:55:58Z

Yes, the developers’ reactions put me off as well. Quite frankly, if I were using the KeePassXC browser extensions, I’d probably want to switch to an other password manager too.

Right now I use KeePassXC locally (and KeePassDX on Android) and I’m fully satisfied with the interface and the security behind the software. I also use Proton Pass alongside it (this time with the web extension). So unless there’s a better local alternative than KeePassXC/KeePassDX, I’ll probably stick with it. As for @Natha recommendation of Pass, it seems we still know too little about that solution, even if it looks interesting.

PS : Privacy Guides also recommends this option for local storage : [https://www.gopass.pw/](https://www.gopass.pw/)

It seems interesting.

---

## Post 56 by @saphypbe — 2025-08-25T17:19:23Z

From a developer perspective, if I want to protect some clients from this, what would be the best approach?

1. email sign-in only
2. passkey (biometrics, hardware)
3. ~~SSO with Google/Github~~ (privacy-invasive)

Holding on a database with email/password looks dangerous.  
Not sure how ready people are to new alternatives.

---

## Post 57 by @Natha — 2025-08-25T17:29:39Z

Passkeys. If implemented correctly (check the original article in my first message).

---

## Post 58 by @anonymous378 — 2025-08-25T18:46:03Z

> [@Natha](#):
>
> KeePass is **not** safe. An update is in the work as we speak. But there was a bit of drama between the devs and the security researcher on KeePass GitHub… : [Clickjacking vulnerability · Issue #1367 · keepassxreboot/keepassxc-browser · GitHub](https://github.com/keepassxreboot/keepassxc-browser/issues/1367)

Yeah I totally misunderstood that. Thanks for the clarification.

---

## Post 59 by @Cyber-Typhoon — 2025-08-25T19:10:20Z

Since this vulnerability is available for some time don’t everyone using password manager extensions with autofill needs to update ALL their credentials?

---

## Post 60 by @NovaViper — 2025-08-26T00:23:48Z

@Natha Hey it looks like the KeepassXC devs are actually working on a fix!

> <https://github.com/keepassxreboot/keepassxc-browser/issues/2645>
>
> Potential issue that may need eyeballs.
> 
> Pretty much ALL password manager browse…r extensions appear to suffer from a DOM clickjack.
> 
> https://thehackernews.com/2025/08/dom-based-extension-clickjacking.html?m=1
> 
> I'm just the messenger.

---

## Post 61 by @NovaViper — 2025-08-26T03:48:50Z

This I want to know too, I _ **REALLY** _ hope I don’t have to go and do that. :eyes: Should the recommended mitigation right is to outright remove any and all password manager extensions and change all passwords in said manager?

---

## Post 62 by @jonah — 2025-08-26T04:36:00Z

> [@saphypbe](#):
>
> passkey (biometrics, hardware)

Yes.

> [@saphypbe](#):
>
> email sign-in only

Technically also better, yes, but I personally hate any website that does this and avoid them whenever possible lol

If I were making an app today I would implement both options, making sure never to default to sending an email if the user also has a Passkey enabled, plus optional TOTP 2FA.

---

## Post 63 by @anonymous411 — 2025-08-26T04:49:11Z

Is this something to be concerned about if I only visit non-attacker controlled websites?

---

## Post 64 by @marektoth — 2025-08-26T08:14:37Z

> Is this something to be concerned about if I only visit non-attacker controlled websites?

It depends on which password manager you use—whether it has already fixed the clickjacking vulnerability or not.

And if you only visit non–attacker controlled websites, how can you be sure they are 100% safe? XSS vulnerabilities are very common. More in my [post](https://x.com/marektoth/status/1959906339943035320). For example, LastPass chooses not to fix this and thus exposes its users to risk.

---

## Post 65 by @saphypbe — 2025-08-26T10:28:02Z

I agree that email-only login access is not the most practical.  
But it’s also safer in case of a DB leak with email/password combo.

Best is a passkey. Not sure how familiar people might be with that kind of workflow (easier or slower adoption).

Idea is a privacy-focused product, the less I know about my customers the better for them.

---

## Post 66 by @anon1964798 — 2025-08-27T05:47:06Z

I’m surprised on how the Bitwarden team is taking the issue very casually and not releasing emergency fixes for this issue. I am happy on how fast the proton pass team reacted. I didnt expect this as they were new in the password manager industry. I’m planning to switch my password manager from bitwarden to proton pass.

---

## Post 67 by @saphypbe — 2025-08-27T06:32:16Z

The issue is easily fixable on the end user side.  
Understandable that Bitwarden is not in a hurry, it is not a severe security flaw.

---

## Post 68 by @anon1964798 — 2025-08-27T18:03:01Z

There 13 million users of bitwarden chrome extension. Out of 13 million how many people know about this issue and how many are non advanced users. As a company they should immediately do something as we are trusting them with our passwords.

---

## Post 69 by @saphypbe — 2025-08-28T07:50:26Z

People that install a browser extension increase their attack surface in the first place (convenience is the enemy of security usually).  
Not all people use the cloud version of Bitwarden, some use their own self-hosted Vaultwarden (and should have the due-dilligence of checking from time to time).  
Even less people are exposed to such a vulnerability as of today, this clickjacking exploit is not widespread on 99% of websites.  
I can only see 5M chrome installs + 0.8M firefox ones.  
Moreover, searching for “bitwarden firefox extension” in a search engine, brings Marektoth’s article as the 2nd link.

Overall, Bitwarden should not carry all the blame here.  
And bad vulnerabilities happen all day, this doesn’t mean the team needs to have a sleepless night and rush a hotfix nor it should push you to migrate to another password manager in itself.

---

## Post 70 by @RevealedInWords — 2025-09-02T02:07:52Z

Bitwarden has handled this situation very poorly IMO. Version 2025.8.0 was supposed to have fixed it, but it did not. Then 2025.8.1 was said to be the solution, but it was not. And I can find no mention of it on their site or Git, except in this one forum thread: [Should I be worried about clickjacking? - #33 by gooseleggs - 🔹Password Manager - Bitwarden Community Forums](https://community.bitwarden.com/t/should-i-be-worried-about-clickjacking/87988/33)

Apparently this vulnerability is STILL not resolved? Or am I missing something?

---

## Post 71 by @donutfreak — 2025-09-02T04:57:45Z

Bitwarden only does community support through their forums. They push official stuff to a support email address. I too haven’t seen a “we are done” type of message regarding these clickjacking issues. You’d think they’d be on this.

---

## Post 72 by @saphypbe — 2025-09-02T08:28:31Z

Github is the way to go, post an issue there or check the code on your machine locally.  
Even better solution: disable autofill.

It’s not a CVE so nobody will rush to fix it.

---

## Post 73 by @pika — 2025-09-06T16:41:02Z

> [@RevealedInWords](#):
>
> Then 2025.8.1 was said to be the solution, but it was not

This is true version-2025.8.1 did not fix it. The login credential vulnerability still existed. I had tested it myself.  
Only 2025.8.2 seems to fix it now , which was released like a day ago.  
Yeah they did say they earlier that it was fixed when really it was not. The researcher himself had pointed this out in a post on the bitwarden forums. You can see here [Should I be worried about clickjacking? - #24 by marektoth - Password Manager - Bitwarden Community Forums](https://community.bitwarden.com/t/should-i-be-worried-about-clickjacking/87988/24)

If you want to make sure its fixed you can try the researchers [demo website](https://websecurity.dev/password-managers/dom-based-extension-clickjacking/) which made it very easy for anyone to test whether they were being affected by it or not.

---

## Post 74 by @user1 — 2025-09-07T07:06:10Z

> [@pika](#):
>
> Only 2025.8.2 seems to fix it now

I still fail the opacity:0.5 test with bitwarden extension 2025.8.2 on firefox.  
How did you manage to positive test it?

---

## Post 75 by @anon1456190 — 2025-09-08T18:53:22Z

Did you test on any chromium based browser?

---

## Post 76 by @anon83428815 — 2025-11-12T20:24:45Z

> **[Proton Pass is protected against clickjacking attacks | Proton](https://proton.me/blog/proton-pass-is-protected-against-clickjacking-attacks)**
>
> Following a report about clickjacking at DEF CON 33, we addressed a vulnerability in Proton Pass: Find out more

> In short, **the Proton Pass browser app is no longer vulnerable to reported clickjacking attacks.** We were alerted to this vulnerability by a report by cybersecurity researcher Marek Tóth given at DEF CON 33.
> 
> […]
> 
> **We’ve addressed this vulnerability with the rollout of version 1.31.6 of the Proton Pass, and would strongly recommend updating your Proton Pass web app if you haven’t already.**