Our team recently investigated and resolved a bug affecting certain LastPass extensions. Tavis Ormandy, a security researcher from Google’s Project Zero, responsibly disclosed the issue to us. His report revealed a limited set of circumstances on specific browser extensions that could potentially allow an attacker to create a clickjacking scenario.
To exploit this bug, a series of actions would need to be taken by a LastPass user including filling a password with the LastPass icon, then visiting a compromised or malicious site and finally being tricked into clicking on the page several times. This exploit may result in the last site credentials filled by LastPass to be exposed. We quickly worked to develop a fix and verified the solution was comprehensive with Tavis.
We have now resolved this bug; no user action is required and your LastPass browser extension will update automatically.
Additionally, while any potential exposure due to the bug was limited to specific browsers (Chrome and Opera), as a precaution, we've deployed the update to all browsers.
We know the LastPass community is very security-savvy, but as a reminder LastPass continues to recommend the following general best practices for added online security:
- Beware of phishing attacks. Do not click on links from people you don’t know, or that seem out of character from your trusted contacts and companies.
- Always enable MFA for LastPass and other services like your bank, email, Twitter, Facebook, etc. Adding additional layers of authentication remains the most effective way to protect your account.
- Never reuse your LastPass master password and never disclose it to anyone, including us.
- Use different, unique passwords for every online account.
Keep your computer malware-free by running antivirus with the latest detection patterns and keeping your software up-to-date.
As always, we welcome (and incentivize) contributions from the security research community through our bug bounty program. We appreciate the important work that white hat researchers provide in augmenting the security of LastPass for all of our users.
