Update on DOM-Based Extension Clickjacking Vulnerability in Enpass Browser Extension (FIXED)

Earlier this year, we learned about a browser extension vulnerability that could have exposed users to clickjacking. We acted promptly to investigate, patch, and ultimately release a complete fix. 

Here's what happened 

On April 7, 2025, security researcher Marek Tóth contacted Enpass to responsibly disclose a clickjacking vulnerability in the Enpass browser extension. 

Clickjacking is a web-based attack where a malicious site tricks users into clicking something unintended. In this case, a malicious webpage could exploit the vulnerability to trick a user into stealing a credential stored in Enpass by altering the attributes such as transparency of the inline autofill menu.  

How We Responded Promptly 

As soon as we were notified, the Enpass team immediately acknowledged and began working on a fix. 

What You Should Do 

To stay protected, make sure you’ve updated to the latest version (6.11.6) of the Enpass browser extension.  

We extend our sincere appreciation to Marek Tóth who reported this issue responsibly.