Browser Extension Clickjacking: One Click and Your Credit Card Is Stolen

by Marek Tóth

Day 2 · LVCC - L1 - Exhibit Hall West 3 · Track 1 · 45 min · 4 min read

Offensive Security Application Security

TL;DR

Marek Tóth demonstrated two browser extension clickjacking techniques against 11 password managers, all of which were vulnerable. The iframe-based variant exploits misconfigured web_accessible_resources in manifest.json. The DOM-based variant manipulates opacity or overlays of extension-injected UI elements to trick users into triggering autofill. Six of nine managers leaked credit card numbers with no XSS required. Three clicks on an XSS-compromised subdomain yield username, password, and TOTP. Bitwarden and 1Password remain unpatched. The affected extensions had roughly 40 million active installs.

Why Clickjacking Still Works Against Browser Extensions

▶ Watch (1:40)

Clickjacking is out of scope on most bug bounty programs. X-Frame-Options and Content-Security-Policy headers protect most web apps. Browser extensions are a different target. Extensions handle authentication that persists across browser sessions, and developers must set their own security rules. Browsers enforce same-origin policy for web apps but not for extensions. Tóth reported clickjacking vulnerabilities and received bounties, including one “nice bounty,” proving the attack still carries real impact. He tested 11 password manager extensions. All were vulnerable.

Iframe-Based Attack: Stealing a NorthPass Vault with Four Clicks

▶ Watch (11:42)

In December 2023, Tóth found NorthPass exposed its entire app interface (app.html) in web_accessible_resources under manifest v2, which lacked a matches restriction. Any external domain could load the full NorthPass UI in an iframe at opacity zero. Overlaying a fake Cloudflare CAPTCHA, the demo shows a user solving a puzzle and clicking “Verify,” unknowingly sharing all vault items with the attacker. Four clicks. The victim received no notification. NorthPass paid $10,000. Shared items included passwords, credit cards, and passkeys.

▶ Watch (14:49)

DOM-based clickjacking skips the iframe entirely. Password managers inject autofill UI elements directly into the page DOM. A malicious script sets those elements’ opacity to zero, hiding the autofill dropdown while luring the user into clicking something else. Tóth documented six attack variants: targeting the extension’s root element, targeting a child element when the root uses a randomized suffix, hiding the page body while showing a background screenshot, targeting the HTML element, partial overlay with divs placed around the visible autofill menu, and full overlay using the Popover API with pointer-events set to none.

Credit Card Theft Requires No Vulnerable Domain

▶ Watch (31:51)

Credit cards and personal data (name, email, phone, address) are not domain-specific and autofill anywhere. An attacker runs the exploit on their own website with no XSS required. Six of nine password managers that support manual credit card autofill were vulnerable. Eight of ten were vulnerable for personal data. The RoboForm demo shows a user clicking through a fake CAPTCHA and cookies banner, then the attacker’s terminal displays the card number, expiry date, and security code within seconds.

▶ Watch (34:36)

For credentials, a second path uses XSS or subdomain takeover on a trusted domain. All password managers autofill on any subdomain by default: credentials saved for account.google.com appear on every Google subdomain. An attacker with XSS on one subdomain can chain multiple fake dialogues and extract the username, password, and TOTP code in three clicks. Nine of ten managers were vulnerable. The live demo showed credentials for a Google account and a matching TOTP code extracted from a simulated XSS payload shared as a link on X.

Fix Status and What Users Can Do

▶ Watch (48:01)

Tóth reported all vulnerabilities in April and presented results in August. NorthPass, Proton Pass, RoboForm, Dashlane, and Keeper have patched. Bitwarden and 1Password remain vulnerable. About 40 million installations were active when Tóth filed the reports. No simple mitigation exists for DOM-based attacks. Tóth recommends disabling manual autofill and using copy-paste, or in Chromium-based browsers setting extension site access to “on click” to require explicit permission before each autofill session. A new browser API may be needed for a real fix.

Notable Quotes

And the results are that all of them. Marek Tóth · ▶ 31:15

So basically just one click anywhere on Marek Tóth · ▶ 30:53

I’m not sure if I will click anywhere Marek Tóth · ▶ 43:14

and no vulnerability is needed to leak Marek Tóth · ▶ 49:03

Key Takeaways

Browser extension clickjacking bypasses traditional iframe protections by targeting extension-injected DOM elements directly
Six of nine password managers leaked credit card numbers from the attacker’s own website with no XSS needed
All tested password managers autofill credentials on any subdomain by default, extending XSS blast radius to TOTP codes
Bitwarden and 1Password were still unpatched the morning of the talk, covering millions of active users
No simple browser-level fix exists; a new browser API may be required to protect extension UI from opacity manipulation

About the Speaker(s)

Marek Tóth is a security researcher from the Czech Republic specializing in web application security. He works as a penetration tester by day and conducts independent research in his free time, with a recent focus on Czech companies. He reports critical vulnerabilities to vendors and shares findings on his personal website, YouTube channel, and at conferences, primarily at OWASP Chapter meetups.

Filed under

Offensive Security Application Security