The clickjacking attack that steals passwords — and how Vauz stops it

Autofill is the best feature a password manager has, and the one you think about least. You click a field, the little icon appears, you pick your account, and you’re in. Two seconds. No friction. It feels like nothing happened.

Something did happen, though. Your password left your vault.

That’s worth sitting with for a second, because it’s the one moment in the whole arrangement where a secret you’ve been carefully protecting gets handed to something else. Not stored. Not encrypted. Handed over.

And it’s handed to a browser extension — which is a fine thing to be, but a rough neighbourhood to work in. An extension does its job inside a program that is, by design, running code written by strangers on every tab you open. Nothing about that makes extensions untrustworthy. It does mean anything an extension holds is sitting in the most contested part of your computer.

Which is why the Vauz extension is deliberately built to be worth very little on its own. It holds no vault and no keys. It cannot decrypt anything. It cannot release a credential by itself — it can only ask the Vauz app, and the app is what decides. Rob it and you get an errand runner with empty pockets.

The handoff is the interesting part

Everything else a password manager does is about keeping things still. Encryption keeps your vault unreadable. Local storage keeps it from travelling. All of that is about not moving.

Autofill is the exception. It’s the part where things move on purpose.

So it’s a strange place for the design to go quiet. You approved the vault opening — you typed something, or touched a sensor. But the moment a credential actually leaves? That one usually passes without a word.

Until recently, you could argue that was fine. Then somebody demonstrated otherwise.

One invisible click

In August 2025, security researcher Marek Tóth presented DOM-based extension clickjacking  at DEF CON 33. The idea is unpleasantly simple.

Password manager extensions draw their autofill UI into the web page — the little icon, the dropdown of accounts. Anything drawn into a page is subject to that page’s rules. So a malicious site sets the extension’s dropdown to fully transparent, then draws something you’d plausibly click in the same spot. A cookie banner. A CAPTCHA. A dismiss button.

You click what you can see. You actually click what you can’t.

Tóth tested 11 password managers and estimated roughly 40 million active installations were exposed. Depending on the variant, one to three clicks were enough to lift credit card details, addresses, usernames, passwords, TOTP codes — and in some cases hijack a passkey assertion outright.

The really uncomfortable part is that nothing was broken. No encryption failed. No vault was cracked. The extension did precisely what it was built to do — fill a form on request — and the page simply arranged for the request to come from you without your knowledge.

Note

Vauz was not among the products in that research, and we’re not going to pretend it was. What follows is about architecture, not a test result.

You cannot draw over a fingerprint prompt

Here’s the thing a web page can and cannot do.

Inside its own document, a page is sovereign. It can move, hide, restyle, layer and fake anything that lives there — including UI an extension injected. That’s not a bug in the browser; that’s what a document is.

Outside the page, it has no reach at all. It cannot draw over macOS’s Touch ID prompt. It cannot fake a window belonging to a different application. It cannot make you approve something in a program it has no access to.

So the defence isn’t a cleverer dropdown. It’s moving the decision out of the page entirely.

That’s what Vauz 1.4.2  does. Every autofill request now has to be approved before anything leaves the vault. Touch ID where your Mac supports it. A Vauz window asking for your V-Key if you’ve set one. And if you’ve set neither, a plain confirmation dialog naming the site — because the V-Key is optional, and “you skipped the setup screen” is a poor reason to be handed the weakest possible outcome.

A word on that, since it surprises people: Vauz doesn’t hang your encryption on a master password. Your entries are encrypted regardless, with a key held by your operating system’s own keystore and bound to your machine — so an entry is unreadable on someone else’s computer whether or not you ever configure anything. The V-Key is a second gate you can add on top. We’d rather the baseline be strong for people who never get round to the setup screen than make encryption the reward for reading it carefully.

Those three prompts aren’t equally strong, and it would be silly to claim otherwise. A fingerprint proves a person is present. A V-Key proves someone knows a secret. A confirmation dialog only proves somebody clicked something.

But against this attack, the ranking matters less than you’d think — because all three happen outside the page. The website cannot set them to opacity: 0. It cannot put a fake cookie banner over them. It cannot reach them at all. Even the weakest rung is on the far side of a boundary the exploit depends on crossing.

It’s also, as it happens, what Tóth recommended. His write-up puts it plainly: “The safest solution is to display a new popup window” — while noting, fairly, that it costs users convenience.

We think that’s the right trade, and we’d rather argue for it honestly than pretend it’s free.

Built to be read, not clicked through

Leaving the page is the structural half — it puts the decision somewhere the attack cannot reach. The other half is making the prompt worth stopping for, because a confirmation nobody reads is just a slower click.

So it’s deliberately specific:

• It names the site. Not “a website” — the actual domain, spelled out, so a look-alike address has to survive you looking straight at it.
• It names the extension, and says whether Vauz recognises it. One it can’t vouch for is labelled as exactly that, rather than quietly given the benefit of the doubt.
• Deny is the default. Hit Return on autopilot and nothing is released. The careless answer is the safe one.
• Ignoring it is also a refusal. An unanswered prompt expires on its own, instead of sitting there waiting for whoever’s next at your desk.
• It looks like Vauz, down to the logo and the styling, because a window asking for your V-Key is exactly the window worth faking.

Against Tóth’s attack, the first line does most of the work. The entire trick depends on you not knowing a credential is moving. A prompt naming a site you’ve never heard of, at a moment you weren’t expecting anything, is hard to click through by accident.

Where this stops being absolute

Now the honest part, because a security claim without its limits is just marketing.

Approving a site covers it for two minutes. Sign-in forms that span two pages would otherwise ask twice, and some ask three times — a prompt on every field is how you build something people switch off.

But a grace period is a gap, and it’s fair to ask what fits through it. Tóth’s most serious variant assumes an attacker already has script execution on a domain you trust. In that case the prompt names the real site, because it is the real site. What’s anomalous isn’t the domain — it’s that you’re being asked at all while reading an article.

That’s a weaker signal than an unfamiliar domain, and we’d rather say so.

Which is why Prompt for authentication on every autofill exists in the extension settings. It removes the grace period completely and asks every single time. For most people the two-minute default is the sane trade. If your threat model includes a compromised site you already use, it isn’t, and the switch is there.

We picked a default. We didn’t pretend it’s the only defensible answer — and the default is the part that actually matters, because most people never open settings at all.

The rest of 1.4.2, briefly

The approval work was the centrepiece, but it wasn’t alone.

Import and export, finally. You can move your vault between copies of Vauz — off one machine and onto another, which is what most people wanted it for. Not to and from other password managers, though. Not yet. Encryption is on by default, export passphrases have to clear a real strength check, and writing the file needs a fresh Touch ID or V-Key confirmation — one that can’t be reused for anything else. Export unencrypted and you get a plain warning first, with cancel as the default. Import reports exactly how many entries landed and flags anything unreadable, so a partial file never passes for a complete one.

A rebuilt password list. Compact cards that open in place and show nothing until you open them. Pin the ones you use constantly. Search counts as you type — 12 of 10,003 — so you can see how much a term narrowed things.

Big vaults stopped being a problem. Tens of thousands of entries now load, scroll and search instantly. That one was a genuine bug: large vaults used to crawl, and sometimes didn’t render at all.

Locking means locked. Passwords are loaded only after you authenticate and cleared the moment the vault locks — not covered by a screen drawn on top of them.

There’s a full changelog  if you want the rest. It’s long, and most of it is unglamorous fixes.

What this costs you

A few seconds, occasionally. That’s the honest accounting.

What you get is an answer to a question most people can’t answer about their own setup: what would it look like if something asked my password manager for a credential and I hadn’t meant it to?

For a lot of people in August 2025, the answer turned out to be: exactly like clicking a cookie banner. With Vauz 1.4.2, it looks like your Mac asking for your fingerprint, next to the name of a website you didn’t expect — on a surface no page can reach.

Same instinct as keeping your vault on your device in the first place: fewer things you have to take on faith, more things you can simply see.

Vauz is free for life on the free plan, and 1.4.2 is out now. If you want to know what the approval prompt is telling you, Support has a walkthrough of the Release saved logins window  and a guide to the autofill extension .