KeePassXC-Browser Credential Autofill Vulnerability in Sandboxed Iframes

A vulnerability exists in KeePassXC-Browser versions through 1.9.9.2, where the extension improperly autofills or prompts to fill credentials in documents under a browser-enforced Content Security Policy (CSP) directive with sandboxed iframes. This flaw allows attacker-controlled scripts in the sandboxed context to access and exfiltrate filled form data. The issue arises because the extension fails to recognize and respect the security restrictions imposed by the browser on sandboxed content, even within the same domain.

Impact

Exploitation of this vulnerability allows for unauthorized access to and exfiltration of stored credentials from forms in documents rendered within sandboxed iframes.

Remediation

Users can update to KeePassXC-Browser version 1.9.9.3, which includes a fix for this vulnerability by preventing credential autofill in sandboxed iframes.