lastpass browser extension vulnerabilities

LastPass' efficiency in keeping passwords away from prying eyes was proven this summer when the company couldn't answer legal demands from the US Drug Enforcement Administration (DEA). Using a password manager is many times better than leaving passwords stored inside a browser, from where they can be easily extracted by forensic tools and malware. Like any other applications, password managers are sometimes vulnerable to bugs, which are in all cases eventually fixed.ĭespite this vulnerability, users are still advised to rely on a password manager whenever they can. Don't abandon password managers because of a fixable bug A LastPass spokesperson did not return a request for comment. Since the vulnerability was discovered and then privately reported by Google, there's no reason to believe the bug has been exploited in the wild. 'I think it's fair to call this 'High' severity, even if it won't work for *all* URLs,' Ormandy said. According to Ormandy, this isn't as hard as it sounds, as an attacker could easily disguise a malicious link behind a Google Translate URL, trick users into visiting the link, and then extract credentials from a previously visited site.

Since the bug relies on executing malicious JavaScript code alone, with no other user interaction, the bug is considered dangerous and potentially exploitable.Īttackers could lure users on malicious pages and exploit the vulnerability to extract the credentials users had entered on previously-visited sites.

The security researcher's bug report walks an attacker through the steps necessary to reproduce the bug.

This is because yesterday, Ormandy published details about the security flaw he found.

If users have not enabled an auto-update mechanism for their LastPass browser extensions, they're advised to perform a manual update as soon as possible. In a blog post, the company said the bug only impacts its Chrome and Opera browser extensions. LastPass, believed to be the most popular password manager app today, fixed the reported issue in version 4.33.0, released last week, on September 12. The bug was discovered last month by Tavis Ormandy, a security researcher with Project Zero, Google's elite security and bug-hunting team. 10 dangerous app vulnerabilities to watch out for (free PDF).

Lastpass browser extension vulnerabilities