While analyzing Bitwarden, Flashpoint's researchers discovered that the extension also auto-fills forms defined in embedded iframes, even those from external domains.įilling both the legitimate website's login form and the external iframe (Flashpoint) If the auto-fill option is enabled, it fills them automatically upon the page load without the user having to do anything.

When its users visit a website, the extension detects if there's a stored login for that domain and offers to fill in the credentials. (Un)conditional auto-fillīitwarden is a popular open-source password management service with a web browser extension that stores secrets like account usernames and passwords in an encrypted vault.

The issue was reported by analysts at Flashpoint, who said Bitwarden first learned of the problem in 2018 but chose to allow it to accommodate legitimate sites that use iframes.Īlthough the auto-fill feature is disabled on Bitwarden by default, and the conditions to exploit it aren't abundant, Flashpoint says there are still websites that meet the requirements where motivated threat actors can attempt to exploit these flaws.

Bitwarden's credentials autofill feature contains a risky behavior that could allow malicious iframes embedded in trusted websites to steal people's credentials and send them to an attacker.

Bitwarden autofill windows