CVE-2025-65203
📋 TL;DR
KeePassXC-Browser versions through 1.9.9.2 automatically fill or prompt to fill stored credentials into documents rendered under browser-enforced CSP directives and iframe sandbox attributes. This allows attacker-controlled scripts in sandboxed documents to access populated form fields and exfiltrate credentials. Users of KeePassXC-Browser browser extension are affected.
💻 Affected Systems
- KeePassXC-Browser
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers can steal stored credentials from KeePassXC-Browser by embedding malicious iframes on compromised websites, leading to account takeover and credential theft.
Likely Case
Credential theft from users visiting malicious websites with specially crafted iframes that bypass browser security controls.
If Mitigated
Limited credential exposure if users avoid untrusted websites and have additional browser security extensions.
🎯 Exploit Status
Exploitation requires user interaction (visiting malicious website) but no authentication. Proof of concept demonstrated in GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9.9.3 and later
Vendor Advisory: https://github.com/keepassxreboot/keepassxc-browser/issues/2647
Restart Required: No
Instructions:
1. Open your browser's extension management page. 2. Locate KeePassXC-Browser extension. 3. Check for updates or manually update to version 1.9.9.3+. 4. The extension will update automatically if browser extensions auto-update is enabled.
🔧 Temporary Workarounds
Disable KeePassXC-Browser Autofill
allTemporarily disable automatic credential filling in KeePassXC-Browser settings
Use Browser Content Security Policy
allImplement strict CSP headers on websites to restrict iframe usage
🧯 If You Can't Patch
- Disable KeePassXC-Browser extension until patched
- Use browser settings to block iframes on untrusted websites
🔍 How to Verify
Check if Vulnerable:
Check KeePassXC-Browser extension version in browser extensions page. If version is 1.9.9.2 or earlier, you are vulnerable.Check Version:
Browser-specific: Chrome: chrome://extensions/, Firefox: about:addonsVerify Fix Applied:
Verify KeePassXC-Browser extension version is 1.9.9.3 or later in browser extensions page.📡 Detection & Monitoring
Log Indicators:
- Unusual iframe loading patterns in browser logs
- Multiple credential autofill attempts from same page
Network Indicators:
- Credential exfiltration to unexpected domains
- Suspicious iframe sources in network traffic
SIEM Query:
web_proxy: (url="*iframe*" AND user_agent="*KeePassXC*") OR (http_method=POST AND url_contains="credentials" AND src_ip=internal)