Popular password managers auto-filled credentials on untrusted websites

Dashlane, Bitwarden, and Safari all cited by Google researchers

UPDATED Security shortcomings mean that multiple password managers could be tricked into auto-filling credentials on untrusted pages, security researchers at Google warn.

The team from Google went public with their findings on Tuesday (17 January), 90 days after notifying the applications – Dashlane, Bitwarden, and the built-in password manager bundled with Apple’s Safari browser – of the vulnerabilities.

Both Dashlane and Bitwarden have updated their software although Dashlane, at least, remains unconvinced that the bug represents any kind of security threat. The status of any fix for Apple’s Safari built-in password manager remains unconfirmed at the time of writing. The Daily Swig has asked Apple to comment and we’ll update this story as and when more information comes to hand.

Catch up with the latest cybersecurity research news

The security shortcomings outlined by Google mean that the vulnerable password managers auto-fill credentials into untrusted pages, without first requiring users to enter their master password.

An advisory from Google explains that the issue arises in two scenarios: where web pages have a CSP (content security policy) sandbox response header or where forms are inside a sandboxed iframe.

Auto-filling by password managers should not happen in either scenario but the affected applications all fail in this regard when encountering sandboxed content. Other password managers (including LastPass, 1Password, and Google Chrome’s password vault technology) avoid this mistake, said Google.

“Password managers should check whether content is sandboxed before auto-filling credentials. This can be done in many ways, but one way is to check self.origin of a page and refusing to fill in credentials if self.origin is ‘null’,” according to the Google advisory.

Real world impact

In response to a query from The Daily Swig, Bitwarden confirmed that the issue had been resolved through a recent pull request. Dashlane told The Daily Swig that it had also updated its technology even though it remains unconvinced there was ever a substantive problem in play.

We never submit or propose credentials for a domain when it has not been saved by the user previously - so in that specific use case, we don't see a concrete attack scenario that would lead to credential stealing.

The findings published by Google’s security team have been helpful in improving the way we communicate with our customers in autofill scenarios.

We always welcome collaborating with security researchers to identify threats and potential attacks so that we can evolve our security architecture and keep offering the highest level of protection to our users.

Google is yet to respond to a request from The Daily Swig to respond to Dashlane’s comments on its research findings.

This story was updated on 23 January to incorporated a revised statement from Dashlane on Google's disclosure.