Browser Extension Risk Clickjacking

Hi @chrisrosa,

We've released a security advisory that we'll keep updated with any new developments.

We've also released version 8.11.7.2 (or 8.11.7 for Safari) of the 1Password browser extension, which gives users and businesses the option of turning on confirmation popups for sensitive data autofill. This approach reduces the likelihood of harm resulting from this particular class of attack and make sure they are clearly informed when autofill is happening, remaining in control of their user information. This version is now available for Edge, Chrome, and Safari and is awaiting approval from Firefox.

We chose this approach because we identified that many technical controls to detect and prevent clickjacking attacks come with limitations and can often be bypassed or break expected behavior for legitimate sites, as they don’t address the broader class of attack. 
I hope this helps. Please let us know if you have additional questions!

Hi Former Member​ ,

You’ll be happy to hear that we’ve released version 8.11.7.2 (or 8.11.7 for Safari) of the 1Password browser extension, which gives users and businesses the option of turning on confirmation popups for sensitive data autofill, including PII. This version is now available for Edge, Chrome, and Safari and is awaiting approval from Firefox.

Thank you. What I am wondering, however, is that it seems there may be a possibility to fix the reported issues. NordPass, Proton Pass, RoboForm, Keeper, and Dashlane have reportedly already addressed them, and according to Socket, Bitwarden, Enpass, and iCloud Passwords are all actively working on fixes. Could you elaborate on why 1Password cannot fix the demonstrated issues?  

https://socket.dev/blog/password-manager-clickjacking

The video you linked is an example of an older iFrame-based vulnerability and, more importantly, does not apply to 1Password. You can see the same video you referenced in the researcher's paper at:

https://marektoth.com/blog/dom-based-extension-clickjacking/#iframe-based

There, the researcher says:

In this research focused on password managers, one of them had this issue.

In December 2023, I reported this clickjacking vulnerability in the NordPass password manager.

Above that quote, the researcher also stated that he was explaining the iFrame-based vulnerability only as background. It was not the subject of the current research:

I will first describe the IFRAME-based variant, which was not the research focus but may be unknown to many people.

Concerning how 1Password is vulnerable to clickjacking, @1P_SimonH said:

At most, a malicious or compromised webpage could trick you into autofilling one matching item per click, not everything in your account.

The researcher's conclusion agrees with that:

1 click = attacker gets your credentials incl. TOTP (only for vulnerable domain)

Thanks for taking the time to write such a detailed comment @bhx! It’s clear you’ve really thought about both the technical side of this and the practical impact for people who may not be security experts. We share that focus, and your points around defaults, education, and layered defenses are very much in line with the kinds of conversations our teams are having internally.

On the product-hardening side, the research being discussed reviewed a wide range of technical implementations, many of which don’t apply to the 1Password browser extension. Our extension is already built with multiple layers of protection. It prevents other scripts from manipulating the extension interface and enforces strict origin-matching rules that stop unintended iframe autofill and common web-based attacks like many types of XSS.

Because the attack scenario assumes a fully malicious website with complete control over its own scripting and UI, there are limits to what additional preventative measures can achieve. For example, current browser behavior allows Popover APIs to be layered on top of each other, reducing the effectiveness of some proposed alternatives.

To address this risk, we’ve taken a product- and user-focused approach: a confirmation alert makes it clear when autofill occurs. This prompt is especially important for credit card and identity items, which can be autofilled on any webpage or domain. It’s important to note that login items already benefit from extensive safeguards, as they only autofill on domains that match the site saved in 1Password.

We remain committed to strengthening the extension, while also ensuring our protections are practical, reliable, and user-friendly. If you'd like to dig in further, we’ve published both a security advisory and a blog with additional details.

Ah, sorry, I wasn't clear. I was referring to 1Password on my Mac, not on my phone. I tried something as close to what you describe, on my laptop, but did not find anything. 

Still confused, despite your kind attempt to unconfuse me ;^)

[Update 8/21 3:40 AM EST] - 1Password sent BleepingComputer the following comment:

"Clickjacking is not unique to the 1Password browser extension. It is a long-standing web attack technique that affects websites and browser extensions broadly. Because the underlying issue lies in the way browsers render webpages, we believe there’s no comprehensive technical fix that browser extensions can deliver on their own.

We take this and all security concerns seriously, and our approach to this particular risk is to focus on giving customers more control. 1Password already requires confirmation before autofilling payment information, and in our next release, we’re extending that protection so users can choose to enable confirmation alerts for other types of data. This helps users stay informed when autofill is happening and in control of their data." - Jacob DePriest, CISO at 1Password

Thanks for flagging this, and apologies for the delayed response. 😅

Firefox releases can sometimes appear later than other browsers due to Mozilla’s review process. The latest version has been approved since your comment and is live on the Firefox Add-ons site, so you should now be able to update to 8.11.8.40 which includes the fixes mentioned here.

It's not that this is something we've chosen not to fix —  but rather that clickjacking is something no extension can completely fix on its own. There are partial mitigation approaches out there, but in our research and testing, they can break expected behavior without fully eliminating the risk.

The 1Password extension already has safeguards in place to protect against real-world risks like this. Logins only fill on the domains they’re saved for, and the extension blocks scripts from tampering with its interface. Credit cards have always required a confirmation prompt before filling, and in our latest release we’ve extended that same protection to other item types as well.

I hear your point about sometimes approving prompts out of habit — that’s exactly why we’ve focused on visibility and control, so autofill only happens when you mean it to. Paired with shorter auto-lock times, it’s another layer that makes clickjacking much harder to exploit.