DEF CON 33 - Browser Extension Clickjacking: One Click and Your Credit Card Is Stolen - Marek Tóth

Why It Matters

Extension clickjacking can silently exfiltrate financial credentials, exposing millions of users to fraud; robust manifest controls and UI integrity checks are now essential for browser security.

Key Takeaways

• Browser extensions can be tricked into invisible autofill attacks.
• Both iframe and DOM‑based clickjacking bypass typical CSP defenses.
• Manual‑autofill password managers are especially vulnerable to opacity tricks.
• Exploits can steal credit‑card data with as few as four clicks.
• Mitigations require strict manifest matches, CSP headers, and UI integrity checks.

Summary

The DEF CON presentation by Marek Tóth exposed a new class of browser‑extension clickjacking that lets attackers harvest credit‑card and password data with a handful of user clicks. By targeting the manual‑autofill feature of popular password‑manager extensions, the researcher demonstrated how malicious pages can render extension UI elements invisible and capture user input without any visible warning.

Two attack vectors were detailed. The first mirrors classic web clickjacking: a transparent iframe loads an extension’s web‑accessible resource, exploiting missing "matches" in Manifest V2 files. Using North Pass as a case study, Tóth showed that a victim could share an entire vault with an attacker after only four clicks, earning a $10,000 bounty. The second, more novel approach manipulates the DOM injected by extensions—changing opacity, overlaying elements, or using pointer‑events:none—to hide autofill menus from view while still triggering them when the user clicks on intrusive page elements such as cookie banners.

Live demos illustrated the mechanics: opacity‑zero overlays on Proton Pass and other managers caused the autofill dropdown to appear behind a fake consent dialog, allowing the attacker to capture card numbers, expiration dates, and CVVs. The speaker also highlighted the limitations of existing defenses; CSP headers and X‑Frame‑Options often protect traditional sites but not extension‑specific resources, especially when developers rely on Manifest V2 defaults.

The findings underscore an urgent need for extension developers to adopt Manifest V3, explicitly whitelist domains in "matches", enforce strict Content‑Security‑Policy rules, and limit web‑accessible resources to the minimum required. Security researchers and bounty programs should prioritize these vectors, and users should be cautious when granting extensions permission to autofill sensitive data.

Original Description

Browser extensions have become increasingly popular for enhancing the web browsing experience. Common examples are ad blockers, cryptocurrency wallets, and password managers. At the same time, modern websites frequently display intrusive elements, such as cookie consent banners, newsletter subscription modals, login forms, and other elements that require user interaction before the desired content can be displayed.

In this talk, I will present a new technique based on clickjacking principles that targets browser extensions, where I used fake intrusive elements to enforce user interaction. In my research, I tested this technique on the 11 most widely used password managers, which resulted in discovering multiple 0-day vulnerabilities that could affect tens of millions of users. Typically, just one click was required from a user to leak their stored private information, such as credit card details, personal data or login credentials (including TOTP). In some cases, it could lead to the exploitation of passkey authentication.

The described technique is general and can be applied to browser extensions beyond password managers, meaning other extensions may also be vulnerable to this type of attack. In addition to describing several methods of this technique, I will also recommend mitigations for developers to protect their extensions against this vulnerability.