I remember an early LastPass vulnerability exploiting a bug in URL regex parsing behavior of the LastPass browser extension. IIRC it basically gave RCE to any w

I remember an early LastPass vulnerability exploiting a bug in URL regex parsing behavior of the LastPass browser extension. IIRC it basically gave RCE to any website in the browser extension context. That exploit is the reason I don’t use a browser extension for my password manager (which isn’t LastPass). The tradeoff is basically copy/paste from password manager, vs input directly from browser extension. IMO, copy/paste clearly exposes the smaller attack surface, because it exposes max one password through the clipboard buffer (assuming no further chaining of exploits to escape extension or browser sandboxes). Whereas a browser extension must interface with the vault, which exposes potentially multiple passwords to compromise by methods only possible when the extension is installed. (Incidentally, this logic might also explain the popular hesitancy of 1Password users to ~~upgrade~~ migrate to an electron version of the app.)