DOM-Based Extension Clickjacking Exposes Popular Password Managers to Credential and Data Theft
It has been discovered that popular password manager plugins for web browsers are vulnerable to clickjacking security flaws that, in some cases, might be used to steal credit card information, two-factor authentication (2FA) tokens, and account credentials.
In his presentation at the DEF CON 33 security conference earlier this month, independent security researcher Marek Tóth called the approach Document Object Model (DOM)-based extension clickjacking.
According to Tóth, attackers could obtain user data, including credit card numbers, personal information, and login credentials, including TOTP, with just one click on any part of a website under their control. The new method is universal and can be used for different kinds of extensions.
Clickjacking, also known as UI redressing, ...