DOM-Based Extension Clickjacking Exposes Millions of Password Manager Users to Credential Theft
- About Us
- Contact Us
- Editorial Calendar
- Careers
- The Cyber Express by Cyble Vulnerability Disclosure Policy
- Cyble Trust Portal
[](https://thecyberexpress.com/)
- [MagazineDownload](https://thecyberexpress.com/cybersecurity-magazine/ "Cybersecurity Magazine")
- Firewall Daily
* All
[](https://thecyberexpress.com/1200-arrested-operation-serengeti-2-0/)
[](https://thecyberexpress.com/csrf-flaw-cve-2025-8592/)
### 70,000 WordPress Sites Exposed by Inspiro Theme Security Flaw
[](https://thecyberexpress.com/cisa-warns-of-ics-vulnerabilities/)
### CISA Warns of Critical ICS Flaws in Siemens, Tigo Energy, and EG4 Equipment
[](https://thecyberexpress.com/black-hat-usa-2025-ciso-podcast-series-ep-2/)
### Black Hat USA 2025 CISO Podcast Series: Episode 2 Now Live
[](https://thecyberexpress.com/critical-cve-2025-9074-docker-vulnerability/)
### Critical Vulnerability in Docker Desktop Allows Malicious Containers to Access Host System
[](https://thecyberexpress.com/zero-day-patched-in-ios-18-6-2/)
### Apple Patches Zero-Day in iOS 18.6.2 After Targeted Exploits Involving Malicious Image Files
[](https://thecyberexpress.com/dom%e2%80%91based-extension-clickjacking/)
### DOM-Based Extension Clickjacking Exposes Millions of Password Manager Users to Credential Theft
[](https://thecyberexpress.com/russia-targeting-cisco-network-gear/)
### Russia’s FSB-Linked Hackers Targeting Cisco Network Gear Used in Critical Infrastructure
[](https://thecyberexpress.com/europol-reward-qilin-ransomware-group/)
### Europol Says $50k Reward on Qilin Ransomware Group Admins is Fake
### Trending Tags
* Apple
* All
[](https://thecyberexpress.com/black-hat-usa-2025-ciso-podcast-series-ep-2/)
### Black Hat USA 2025 CISO Podcast Series: Episode 2 Now Live
[](https://thecyberexpress.com/black-hat-usa-2025-ciso-series-episode-1/)
[](https://thecyberexpress.com/civil-penalty-over-2022-optus-data-breach/)
### Australian Information Commissioner Seeks Civil Penalty Action Over 2022 Optus Data Breach
[](https://thecyberexpress.com/uae-cybersecurity-council-flags-privacy-risks/)
### Think Before You Download: UAE Cybersecurity Council Issues Warning on Unverified Apps
[](https://thecyberexpress.com/romania-financial-scam-finance-minister/)
### Romania Warns of Financial Scam Impersonating its Newly Re-Appointed Minister of Finance
[](https://thecyberexpress.com/australia-adopts-ot-cybersecurity-standards/)
### Australia Adopts Global OT Cybersecurity Standards to Secure Energy, Water, and Smart Infrastructure
[](https://thecyberexpress.com/federal-contractor-pays-14m-to-settle-fraud/)
### Federal IT Contractor Pays $14.75 Million Fine to Settle Cyber Fraud Charges
[](https://thecyberexpress.com/us-lawmakers-introduce-no-adversarial-ai-act/)
### U.S. Lawmakers Target ‘Adversarial AI’ in Bipartisan Push to Fortify Federal Systems
[](https://thecyberexpress.com/uk-military-unveils-1b-digital-targeting-web/)
### UK Military Unveils £1B ‘Digital Targeting Web’
* All
* How to
* What is
[](https://thecyberexpress.com/top-countries-leading-cybersecurity-race-2025/)
### The Top 8 Countries Leading the Cyber Defense Race in 2025
[](https://thecyberexpress.com/link-building-secrets/)
### The Link Building Secrets Your Competitors Don’t Want You to Know
[](https://thecyberexpress.com/supply-chain-resilience-for-2025/)
### Supply Chain Resilience and Physical Security: Lessons for 2025
[](https://thecyberexpress.com/healthcare-cybersecurity-trends-of-2024/)
### Healthcare Cybersecurity: 2024 Was Tough, 2025 May Be Better
[](https://thecyberexpress.com/ceos-perspective-on-take-down-services/)
### Shield Your Organization: CEO’s Perspective on Take-Down Services
[](https://thecyberexpress.com/microsoft-mandatory-mfa-azure-sign-ins/)
### Microsoft Announces Mandatory MFA for Azure Sign-ins to Bolster Cloud Defenses
[](https://thecyberexpress.com/signal-proxy-to-bypass-blocks-in-russia/)
### How to Set Up Signal Proxy to Help Bypass Censorship in Russia and Venezuela
[](https://thecyberexpress.com/third-party-risk-management-in-healthcare/)
### Why Healthcare CISOs Must Prioritize Third-Party Risk Management
[](https://thecyberexpress.com/tips-to-protect-streaming-platforms/)
### Protect Your Streaming Accounts Now Before It’s Too Late
* All
* Budgets
* Startups
[](https://thecyberexpress.com/cyble-introduces-support-package-in-australia/)
### Cyble Launches Essential 8 Cybersecurity Support Package for Australian Financial Sector
[](https://thecyberexpress.com/starlink-outage-incident-or-cyberattack/)
### Starlink Outage Sparks Cyberattack Speculation—But SpaceX Says Software to Blame
[](https://thecyberexpress.com/replit-ai-agent-incident/)
### Replit AI Agent Deletes Codebase and Lies About It — CEO Issues Apology
[](https://thecyberexpress.com/any-intent-to-pay-a-ransom-uk-govt/)
### Any Intent to Pay a Ransom? UK Government Wants to Know
[](https://thecyberexpress.com/co-op-cyberattack-exposes-data-of-millions/)
### All Co-op Members Hit in April Cyberattack, CEO Breaks Silence
[](https://thecyberexpress.com/federal-contractor-pays-14m-to-settle-fraud/)
### Federal IT Contractor Pays $14.75 Million Fine to Settle Cyber Fraud Charges
[](https://thecyberexpress.com/uk-military-unveils-1b-digital-targeting-web/)
### UK Military Unveils £1B ‘Digital Targeting Web’
[](https://thecyberexpress.com/regeneron-acquire-23andme/)
### After Bankruptcy, 23andMe Finds a Buyer in Regeneron—But What Happens to Your Data?
[](https://thecyberexpress.com/australia-data-breaches-highest-this-decade/)
### Australia’s Data Breach Reporting Numbers Highest in Half a Decade
* Startups
* Budgets
* Research
* Podcast
* Webinar
[](#)No Result View All Result
- [MagazineDownload](https://thecyberexpress.com/cybersecurity-magazine/ "Cybersecurity Magazine")
- Firewall Daily
* All
[](https://thecyberexpress.com/1200-arrested-operation-serengeti-2-0/)
[](https://thecyberexpress.com/csrf-flaw-cve-2025-8592/)
### 70,000 WordPress Sites Exposed by Inspiro Theme Security Flaw
[](https://thecyberexpress.com/cisa-warns-of-ics-vulnerabilities/)
### CISA Warns of Critical ICS Flaws in Siemens, Tigo Energy, and EG4 Equipment
[](https://thecyberexpress.com/black-hat-usa-2025-ciso-podcast-series-ep-2/)
### Black Hat USA 2025 CISO Podcast Series: Episode 2 Now Live
[](https://thecyberexpress.com/critical-cve-2025-9074-docker-vulnerability/)
### Critical Vulnerability in Docker Desktop Allows Malicious Containers to Access Host System
[](https://thecyberexpress.com/zero-day-patched-in-ios-18-6-2/)
### Apple Patches Zero-Day in iOS 18.6.2 After Targeted Exploits Involving Malicious Image Files
[](https://thecyberexpress.com/dom%e2%80%91based-extension-clickjacking/)
### DOM-Based Extension Clickjacking Exposes Millions of Password Manager Users to Credential Theft
[](https://thecyberexpress.com/russia-targeting-cisco-network-gear/)
### Russia’s FSB-Linked Hackers Targeting Cisco Network Gear Used in Critical Infrastructure
[](https://thecyberexpress.com/europol-reward-qilin-ransomware-group/)
### Europol Says $50k Reward on Qilin Ransomware Group Admins is Fake
### Trending Tags
* Apple
* All
[](https://thecyberexpress.com/black-hat-usa-2025-ciso-podcast-series-ep-2/)
### Black Hat USA 2025 CISO Podcast Series: Episode 2 Now Live
[](https://thecyberexpress.com/black-hat-usa-2025-ciso-series-episode-1/)
[](https://thecyberexpress.com/civil-penalty-over-2022-optus-data-breach/)
### Australian Information Commissioner Seeks Civil Penalty Action Over 2022 Optus Data Breach
[](https://thecyberexpress.com/uae-cybersecurity-council-flags-privacy-risks/)
### Think Before You Download: UAE Cybersecurity Council Issues Warning on Unverified Apps
[](https://thecyberexpress.com/romania-financial-scam-finance-minister/)
### Romania Warns of Financial Scam Impersonating its Newly Re-Appointed Minister of Finance
[](https://thecyberexpress.com/australia-adopts-ot-cybersecurity-standards/)
### Australia Adopts Global OT Cybersecurity Standards to Secure Energy, Water, and Smart Infrastructure
[](https://thecyberexpress.com/federal-contractor-pays-14m-to-settle-fraud/)
### Federal IT Contractor Pays $14.75 Million Fine to Settle Cyber Fraud Charges
[](https://thecyberexpress.com/us-lawmakers-introduce-no-adversarial-ai-act/)
### U.S. Lawmakers Target ‘Adversarial AI’ in Bipartisan Push to Fortify Federal Systems
[](https://thecyberexpress.com/uk-military-unveils-1b-digital-targeting-web/)
### UK Military Unveils £1B ‘Digital Targeting Web’
* All
* How to
* What is
[](https://thecyberexpress.com/top-countries-leading-cybersecurity-race-2025/)
### The Top 8 Countries Leading the Cyber Defense Race in 2025
[](https://thecyberexpress.com/link-building-secrets/)
### The Link Building Secrets Your Competitors Don’t Want You to Know
[](https://thecyberexpress.com/supply-chain-resilience-for-2025/)
### Supply Chain Resilience and Physical Security: Lessons for 2025
[](https://thecyberexpress.com/healthcare-cybersecurity-trends-of-2024/)
### Healthcare Cybersecurity: 2024 Was Tough, 2025 May Be Better
[](https://thecyberexpress.com/ceos-perspective-on-take-down-services/)
### Shield Your Organization: CEO’s Perspective on Take-Down Services
[](https://thecyberexpress.com/microsoft-mandatory-mfa-azure-sign-ins/)
### Microsoft Announces Mandatory MFA for Azure Sign-ins to Bolster Cloud Defenses
[](https://thecyberexpress.com/signal-proxy-to-bypass-blocks-in-russia/)
### How to Set Up Signal Proxy to Help Bypass Censorship in Russia and Venezuela
[](https://thecyberexpress.com/third-party-risk-management-in-healthcare/)
### Why Healthcare CISOs Must Prioritize Third-Party Risk Management
[](https://thecyberexpress.com/tips-to-protect-streaming-platforms/)
### Protect Your Streaming Accounts Now Before It’s Too Late
* All
* Budgets
* Startups
[](https://thecyberexpress.com/cyble-introduces-support-package-in-australia/)
### Cyble Launches Essential 8 Cybersecurity Support Package for Australian Financial Sector
[](https://thecyberexpress.com/starlink-outage-incident-or-cyberattack/)
### Starlink Outage Sparks Cyberattack Speculation—But SpaceX Says Software to Blame
[](https://thecyberexpress.com/replit-ai-agent-incident/)
### Replit AI Agent Deletes Codebase and Lies About It — CEO Issues Apology
[](https://thecyberexpress.com/any-intent-to-pay-a-ransom-uk-govt/)
### Any Intent to Pay a Ransom? UK Government Wants to Know
[](https://thecyberexpress.com/co-op-cyberattack-exposes-data-of-millions/)
### All Co-op Members Hit in April Cyberattack, CEO Breaks Silence
[](https://thecyberexpress.com/federal-contractor-pays-14m-to-settle-fraud/)
### Federal IT Contractor Pays $14.75 Million Fine to Settle Cyber Fraud Charges
[](https://thecyberexpress.com/uk-military-unveils-1b-digital-targeting-web/)
### UK Military Unveils £1B ‘Digital Targeting Web’
[](https://thecyberexpress.com/regeneron-acquire-23andme/)
### After Bankruptcy, 23andMe Finds a Buyer in Regeneron—But What Happens to Your Data?
[](https://thecyberexpress.com/australia-data-breaches-highest-this-decade/)
### Australia’s Data Breach Reporting Numbers Highest in Half a Decade
* Startups
* Budgets
* Research
* Podcast
* Webinar
[](#)No Result View All Result [](#) 
[](#)No Result View All Result Home Firewall Daily
DOM-Based Extension Clickjacking Exposes Millions of Password Manager Users to Credential Theft
===============================================================================================
A newly discovered technique, dubbed DOM-based extension clickjacking, has raised serious concerns about the security of browser-based password managers. Despite their role in protecting sensitive information, such as login credentials, credit card data, and TOTP codes (Time-based One-Time Passwords), this attack demonstrates how a single deceptive click can result in total data compromise.
Decoding DOM‑based Extension Clickjacking
Security researcher Marek Tóth revealed DOM‑based extension clickjacking at DEF CON 33 in August. Tóth demonstrated how malicious websites can exploit password manager browser extensions by manipulating [Document](https://thecyberexpress.com/how-to-password-protect-a-word-document/ "Document") Object Model (DOM) elements injected by these extensions.
The core idea involves hiding legitimate autofill interfaces via CSS properties like opacity: 0 or positioning them off-screen. Then, attackers overlay fake UI elements, such as cookie banners or modal windows, to mislead users into clicking what appear to be harmless elements.
These seemingly innocuous interactions can trigger the hidden autofill mechanisms of password managers. As a result, sensitive [data](https://thecyberexpress.com/what-is-data/ "data") like usernames, passwords, credit card details, or even TOTP codes can be captured and exfiltrated by attackers without the user’s awareness.
Scope and Impact
The attack was tested across 11 of the most widely used password manager extensions:
- Credential theft was successful in 10 out of 11 managers.
- Credit card data, including CVV numbers, was extractable in 6 out of 9 tested.
- Personal data exfiltration was possible in 8 out of 10.
- Passkey authentication was compromised in 8 out of 11.
This translates to a potential risk for approximately 40 million users worldwide, based on extension download data from major browser stores. The attack affects not only Chromium-based browsers but also those running other engines.
Exploit Mechanics
The attack consists of several stages:
- User Interaction Hijacking: The attacker presents a fake UI overlay to the user—such as a cookie consent form—designed to encourage interaction.
- Bypassing Overlay Protections: The attacker sets pointer-events: none on the overlay, allowing clicks to pass through to the underlying autofill elements from the password manager.
- Fake Form Injection: Autocomplete-enabled input fields are precisely positioned below the cursor. A JavaScript function captures the autofilled data using onchange [events](https://thecyberexpress.com/cyber-security-events/ "events") or browser console logging.
- Mouse Tracking: JavaScript dynamically tracks the mouse position to ensure that fake form fields align perfectly with user interactions, further improving the accuracy of the exploit.
In some test cases, login credentials and personal data were stolen with just two user clicks. The attack is particularly dangerous because it can bypass domain restrictions. For example, if a vulnerability exists on a subdomain of a large service, it can be exploited to steal credentials from that service’s main login domain.
While passkeys are generally considered more secure due to domain binding, Tóth found that several implementations—such as those from SK Telecom, Hanko, and Authsignal- could be hijacked via the same method. In systems lacking session-bound challenges, attackers can redirect or intercept signed assertions during the login process.
Vendor Responses
Following responsible disclosure in April 2025, several vendors released patches:
- Fixed: Dashlane, NordPass, Keeper, ProtonPass, RoboForm
- Still Vulnerable (as of August 2025): 1Password, Bitwarden, Enpass, iCloud Passwords, LastPass, LogMeOnce
Bitwarden, Enpass, and iCloud Passwords are reportedly working on fixes. However, both 1Password and LastPass have categorized the [vulnerability](https://thecyberexpress.com/firewall-daily/vulnerabilities/ "vulnerability") as “informative,” suggesting they do not view it as a high-priority issue.
To reduce the [risk](https://thecyberexpress.com/what-are-risks-in-cybersecurity/ "risk") of DOM‑based extension clickjacking, users should disable autofill, limit extension access to “on click,” and consider standalone password managers. Developers should implement protection like closed shadow DOMs and mutation observers, though no universal fix exists yet. With real-world demos showing how easily credentials, credit cards, and TOTP codes can be stolen, it’s clear that both users and vendors must act quickly; this is not a legacy issue, but a growing threat.
Share this:
- Click to share on LinkedIn (Opens in new window) LinkedIn
- Click to share on Reddit (Opens in new window) Reddit
- Click to share on X (Opens in new window) X
- Click to share on Facebook (Opens in new window) Facebook
- [More](#)
- [Click to email a link to a friend (Opens in new window) Email](mailto:?subject=%5BShared%20Post%5D%20DOM-Based%20Extension%20Clickjacking%20Exposes%20Millions%20of%20Password%20Manager%20Users%20to%20Credential%20Theft&body=https%3A%2F%2Fthecyberexpress.com%2Fdom%25e2%2580%2591based-extension-clickjacking%2F&share=email)
- Click to share on WhatsApp (Opens in new window) WhatsApp
_Related_
Tags: clickjackingDOM‑based extensionThe Cyber ExpressThe Cyber Express NewsTOTP [Previous Post
Russia’s FSB-Linked Hackers Targeting Cisco Network Gear Used in Critical Infrastructure
](https://thecyberexpress.com/russia-targeting-cisco-network-gear/)[Next Post
Apple Patches Zero-Day in iOS 18.6.2 After Targeted Exploits Involving Malicious Image Files
](https://thecyberexpress.com/zero-day-patched-in-ios-18-6-2/)Next Post 
Apple Patches Zero-Day in iOS 18.6.2 After Targeted Exploits Involving Malicious Image Files
[](#)[](https://cyble.com/request-demo/?utm_source=cyber_express&utm_medium=sidebar)Follow Us On Google News
Latest Cyber News
[](https://thecyberexpress.com/1200-arrested-operation-serengeti-2-0/) Cyber News
African Authorities Arrest 1,200 People, Seize Millions in Massive Cybercrime and Fraud Networks’ Bust
August 22, 2025 [](https://thecyberexpress.com/csrf-flaw-cve-2025-8592/) Firewall Daily
70,000 WordPress Sites Exposed by Inspiro Theme Security Flaw
August 22, 2025 [](https://thecyberexpress.com/cisa-warns-of-ics-vulnerabilities/) Firewall Daily
CISA Warns of Critical ICS Flaws in Siemens, Tigo Energy, and EG4 Equipment
August 22, 2025 [ ](https://thecyberexpress.com/black-hat-usa-2025-ciso-podcast-series-ep-2/)Firewall Daily
Black Hat USA 2025 CISO Podcast Series: Episode 2 Now Live
Categories
Categories Select Category Appointments Budgets Bug Bounty & Rewards Business News Compliance Cyber Essentials Cyber News Cyber Warfare Cybersecurity Awareness Month Dark Web News Data Breach News DDoS Attacks News Deepfake Espionage Features Firewall Daily Gitex2022 Governance Hacker Claims Hacker News Hackers Interview How to Interviews Knowledge Hub Learning & Development Lockbit Ransomware News Main Story Malware News Market Reports Mergers & Aquisitions Partnerships Podcast Policy Updates Press Release Ransomware News Regulations Research Resources Sponsored Content Startups Threat Actors Threat Intelligence Threat Intelligence News Trends Vulnerabilities Vulnerability News What is Whitepapers Workforce
Web Stories
[](https://thecyberexpress.com/web-stories/if-you-do-this-on-telegram-your-bank-account-will-become-zero/)Do This on Telegram, Your Bank Account Will Become Zero [ ](https://thecyberexpress.com/web-stories/ios-18-beta/)If You Install the iOS 18 Beta, Your iPhone Could Be Hacked [ ](https://thecyberexpress.com/web-stories/cricket-world-cup-ticketing-systems/)Cricket World Cup Ticketing Systems Under Cybersecurity [ ](https://thecyberexpress.com/web-stories/nba-finals/)Cyber Threats and Online Ticket Scams During the NBA Finals [ ](https://thecyberexpress.com/web-stories/biometric-data-security-protecting-sensitive-information/)Biometric Data Security: Protecting Sensitive Information
About
The Cyber Express
-----------------
#1 Trending Cybersecurity News and Magazine
The Cyber Express is a handbook for all stakeholders of the internet that provides information security professionals with the latest news, updates and knowledge they need to combat cyber threats.
Contact
For editorial queries: [editor@thecyberexpress.com](mailto:editor@thecyberexpress.com)
For marketing and Sales: [raj@thecyberexpress.com](mailto:raj@thecyberexpress.com)
Quick Links
- About Us
- Contact Us
- Editorial Calendar
- Careers
- The Cyber Express by Cyble Vulnerability Disclosure Policy
- Cyble Trust Portal
Our Address
We’re remote friendly, with office locations around the world:
San Francisco, Atlanta, Rome, Dubai, Mumbai, Bangalore, Hyderabad, Singapore, Jakarta, Sydney, and Melbourne
Headquarters:
The Cyber Express LLC 10080 North Wolfe Road, Suite SW3-200, Cupertino, CA, US 95014
India Office:
Cyber Express Media Network HD-021, 4th Floor, C Wing, Building No.4. Nesco IT Park, WE Highway, Goregaon East, Mumbai, Maharashtra, India – 4000063
© 2025 [The Cyber Express](https://thecyberexpress.com "The Cyber Express") - Cybersecurity News and Magazine.
[](#back-to-top)
Welcome Back!
Login to your account below
Remember Me
[Forgotten Password?](#jeg_forgotform)
Retrieve your password
Please enter your username or email address to reset your password.
[Log In](#jeg_loginform)
Add New Playlist
\- Select Visibility -PublicPrivate
[](#)[](#)No Result View All Result
- [Magazine](https://thecyberexpress.com/cybersecurity-magazine/ "Cybersecurity Magazine")
- Firewall Daily
- Essentials
* Startups
* Budgets
* Research
* Podcast
* Webinar
[](https://facebook.com)[](https://twitter.com)
© 2025 [The Cyber Express](https://thecyberexpress.com "The Cyber Express") - Cybersecurity News and Magazine.
Are you sure want to unlock this post?
Unlock left : 0 Yes No
Are you sure want to cancel subscription?
Yes No \- 00:00 00:00
Queue
Update Required Flash plugin \- 00:00 00:00
Do This on Telegram, Your Bank Account Will Become Zero If You Install the iOS 18 Beta, Your iPhone Could Be Hacked Cricket World Cup Ticketing Systems Under Cybersecurity Cyber Threats and Online Ticket Scams During the NBA Finals Biometric Data Security: Protecting Sensitive Information 