Major password managers can leak logins in clickjacking attacks

Six major password managers with tens of millions of users are currently vulnerable to unpatched clickjacking flaws that could allow attackers to steal account credentials, 2FA codes, and credit card details.

Threat actors could exploit the security issues when victims visit a malicious page or websites vulnerable to cross-site scripting (XSS) or cache poisoning, where attackers overlay invisible HTML elements over the password manager interface.

While users believe they are interacting with harmless clickable elements, they trigger autofill actions that leak sensitive information.

The flaws were presented during the recent DEF CON 33 hacker conference by independent researcher Marek Tóth . Researchers at cybersecurity company Socket later verified the findings and helped inform im