Project Zero has found a number of major flaws in the LastPass extension. https://bugs.chromium.org/p/project-zero/issues/detail?id=884&can=1&q=lastpass https:

Project Zero has found a number of major flaws in the LastPass extension. https://bugs.chromium.org/p/project-zero/issues/detail?id=884&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=88... https://bugs.chromium.org/p/project-zero/issues/detail?id=1188&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=11... https://bugs.chromium.org/p/project-zero/issues/detail?id=1209&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=12... https://bugs.chromium.org/p/project-zero/issues/detail?id=1217&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=12... https://bugs.chromium.org/p/project-zero/issues/detail?id=1225&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=12... At a glance what they have in common is flaws in the scripts that the LastPass extension injects into pages. The injected scripts can communicate with the extension core with a set of RPCs. Each of these issues is a way of tricking the extension into running RPCs from untrusted JavaScript on any web page. The RPCs available allow an attacker to fetch the credentials for any site in the database or even execute arbitrary code on the host.