Re:Autofill in password managers can allow login credentials...
by carlbordum on Tuesday July 27, 2021 @08:26AM
(#27971575)
In my opinion, XSS is not a security issue autofill should deal with at all.
The real issue is if attackers can trick the autofill to fill in a password for a different site. I did a pentest for a password manager a few years ago, and if I remember correctly this type of exploit had been successful against multiple of the big password managers.
The real issue is if attackers can trick the autofill to fill in a password for a different site. I did a pentest for a password manager a few years ago, and if I remember correctly this type of exploit had been successful against multiple of the big password managers.