LastPass exposed 0-day vulnerabilities, allowing accounts to be accessed by malicious websites

LastPass exposed 0-day vulnerabilities, allowing accounts to be accessed by malicious websites

Google Project Zero hacker Tavis Ormandy reported a high-risk 0-day vulnerability was found in the popular password management tool LastPass, allowing malicious websites to fully access users' accounts. The vulnerability has been reported to LastPass, but the details are not disclosed. Coincidentally, Mathias Karlsson, another security researcher, also reported a similar vulnerability in LastPass. It is unclear whether the two vulnerabilities are the same. Karlsson described his findings on his blog: There is a bug in the automatic password filling function of LastPass, allowing malicious websites to fool LastPass to believe that it is another website such as Twitter and steal user login creden. Karlsson recommends that you disable the auto-Fill function. LastPass says it has fixed the vulnerability, which mainly affects Firefox users.

This article permanently updates the link address: