⚡ Weekly Recap: Password Manager Flaws, Apple 0-Day, Hidden AI Prompts, In-the-Wild Exploits & More

Summary: Popular browser password manager plugins were found vulnerable to a technique researcher Marek Tóth calls DOM-based extension clickjacking, which could be exploited to steal credentials, 2FA codes, and credit card details, and was presented at DEF CON 33. As of August 22, fixes had been released by Bitwarden, Dashlane, Enpass, KeePassXC-Browser, Keeper, LastPass, NordPass, ProtonPass, and RoboForm, and the week's high-risk vulnerability list included CVE-2025-43300 affecting Apple iOS, iPadOS, and macOS.
Key Takeaway: The tool people trust to hold their credentials and 2FA codes was itself the attack surface, and the fix only arrived after public disclosure at DEF CON - so the exposure window ran until each vendor shipped its patch.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-43300 CVE-2025-54988 CVE-2025-57788 CVE-2025-57789 CVE-2025-57790 CVE-2025-57791 CVE-2025-7353 CVE-2025-8714 CVE-2025-9037 CVE-2025-9040
Related: Pre-Auth Exploit Chains Found in Commvault Could Enable Remote Code Execution Attacks Cyber Risks ·
CVE-2025-43300: Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability Known Exploited Vulnerabilities · Aug 21, 2025
Apple Patches CVE-2025-43300 Zero-Day in iOS, iPadOS, and macOS Exploited in Targeted Attacks Cyber Risks ·