Clickjack attack steals password managers’ secrets

A researcher demonstrated a DOM-based clickjacking attack that can trick extension-based password managers into autofilling and exposing credentials, payment data, passkeys and TOTP codes; several vendors have partially or fully patched the issue while others are still working on fixes. Recommended mitigations include disabling autofill, restricting extension site access to "on click", and keeping password manager extensions up to date.