At DEF CON 33, researcher Marek Tóth demonstrated a new form of DOM-based extension clickjacking that can manipulate browser autofill prompts and, under certain conditions, affect passkey workflows. Mobile ID World reported that by layering transparent elements over a web page, a malicious site could trick users into interacting with a password manager’s extension UI.
This allowed credentials to be exfiltrated and, in some cases, interfered with WebAuthn processes. The weakness lies in how extensions inject their interfaces into the DOM, rather than in FIDO’s cryptography itself.
Additional coverage from SecurityWeek and TechRadar confirmed the findings and noted that password manager vendors have begun deploying mitigations. These include new confirmation prompts and stricter autofill rules to limit silent credential capture. Keeper also issued a security advisory describing the timeline of fixes and hardening steps for its browser extension.
In a separate DEF CON session, SquareX researchers presented “Passkeys Pwned,” showing how malicious extensions or injected scripts can intercept WebAuthn API calls in the browser. The SquareX Labs write-up explains how attackers could swap in their own keys during registration and later respond to authentication challenges, effectively hijacking the process. Here again, the cryptographic layer of FIDO2 remained intact, with the problem arising from the browser and extension layer.
Mitigations focus on strengthening how relying parties handle authentication sessions. SquareX recommended enforcing challenge binding and validating attestation through the FIDO Metadata Service, as well as applying strict Content Security Policies to reduce the chance of injected scripts intercepting WebAuthn calls. Enterprise administrators are advised to restrict or audit browser extensions that might proxy identity APIs. Vendors have also updated their autofill implementations, while users are encouraged to keep extensions patched and remain wary of suspicious overlays and pop-ups.
While these findings underline vulnerabilities at the interface between users and browser extensions, they do not undermine the core security benefits of passkeys. The attacks described at DEF CON show how implementation flaws can weaken protections if relying parties or extension developers fail to harden their systems.
Passkeys continue to resist phishing and eliminate the risks of shared secrets, but effective safeguards depend on secure integration. Our background explainers on passkeys and WebAuthn risk and hardening passkey UX against UI attacks provide additional context for reducing exposure.
Sources: Mobile ID World, SecurityWeek, TechRadar, Keeper, SquareX Labs
–
By Ali Nassar-Smith
