Starting point would be https://en.wikipedia.org/wiki/LastPass#Security_issues https://en.wikipedia.org/wiki/LastPass#Security_issues, but there's a variety of

Starting point would be https://en.wikipedia.org/wiki/LastPass#Security_issues https://en.wikipedia.org/wiki/LastPass#Security_issues, but there's a variety of other things like automatically filling passwords making you vulnerable to XSS based password stealing, the general disrepair of the extension, it being owned by logmein, the "two factor auth" being entirely clientside (the extension will actually fully start up and autofill whatever page you're on before prompting you for a code) and the fact that they're still trying to charge me for a premium subscription I cancelled ages ago. Personally I use 1password, but there are loads of other ones that don't have a list of security breaches on their wikipedia page.