Hot Take Researcher Exposes Zero-Day Clickjacking Vulnerabilities in Major Password Managers

[Shadowra]

1Password has given it a low priority...

 

[TuxTalk]

Bitwarden fixed it already.

 

[Sorrento]

I use Rumpelstiltskin++ for everything, no one will ever guess that

 

[acyclovir]

Found this site that lets you test for DOM clickjacking on password manager extensions. Pretty eye-opening stuff.

Check it out: DOM-based Extension Clickjacking

A bit wild that this is still an issue in 2026, but here we are.

 

[Parkinsond]

Found this site that lets you test for DOM clickjacking on password manager extensions. Pretty eye-opening stuff.

Check it out: DOM-based Extension Clickjacking

A bit wild that this is still an issue in 2026, but here we are.

Does it work for Keepassxc without extension?

 

[Wrecker4923]

No, because it's a DOM-based injection. Also, many major password managers with extensions, including Bitwarden and KeePassXC, have fixed the problem since then.