CVE-2025-65203: KeePassXC-Browser XSS Vulnerability

CVE-2025-65203 Overview

CVE-2025-65203 is a credential theft vulnerability in KeePassXC-Browser through version 1.9.9.2. The browser extension improperly autofills or prompts to fill stored credentials into documents rendered under browser-enforced Content Security Policy (CSP) directives and iframe sandbox attributes. This flaw allows attacker-controlled scripts within a sandboxed document to access populated form fields and exfiltrate sensitive credentials.

Critical Impact

Attackers can leverage this vulnerability to steal user credentials by tricking KeePassXC-Browser into autofilling passwords into malicious sandboxed iframes, enabling credential exfiltration without user awareness.

Affected Products

• KeePassXC-Browser versions through 1.9.9.2
• All browser platforms where KeePassXC-Browser extension is installed
• Users with credential autofill enabled for web forms

Discovery Timeline

• 2025-12-17 - CVE CVE-2025-65203 published to NVD
• 2026-01-05 - Last updated in NVD database

Technical Details for CVE-2025-65203

Vulnerability Analysis

This vulnerability stems from a logic flaw in how KeePassXC-Browser handles credential autofill decisions. The extension fails to properly evaluate the security context of form fields when they reside within sandboxed iframes or documents governed by restrictive CSP directives. While browser sandboxing mechanisms are designed to isolate potentially untrusted content, the KeePassXC-Browser extension bypasses these security boundaries by autofilling credentials into forms within these restricted contexts.

The weakness is classified under CWE-352 (Cross-Site Request Forgery), as the extension performs sensitive credential operations without adequately verifying the legitimacy and security context of the requesting document. An attacker can embed a malicious sandboxed iframe on a page that mimics a legitimate login form, causing the extension to populate it with stored credentials that can then be captured by attacker-controlled JavaScript within the sandbox.

Root Cause

The root cause lies in insufficient context validation within the KeePassXC-Browser's autofill logic. The extension does not adequately check whether a form field exists within a sandboxed iframe or a document with restrictive CSP policies before populating credentials. This oversight allows the extension to fill credentials into contexts where malicious scripts may have limited browser access but can still read DOM values from form fields populated by the extension.

Attack Vector

The attack leverages the network-based attack vector, requiring user interaction. An attacker can craft a malicious webpage containing a sandboxed iframe designed to mimic a legitimate login form for a site the victim has stored credentials for. When the victim visits this page:

1. The attacker's page includes a sandboxed iframe with a login form that matches a credential entry in the victim's KeePassXC database
2. KeePassXC-Browser detects the form and either autofills credentials or prompts the user to fill them
3. Once credentials are populated, attacker-controlled JavaScript within the sandboxed iframe reads the form field values
4. The attacker exfiltrates the captured credentials through available sandbox-permitted mechanisms

The attack exploits the trust boundary between the browser's security sandbox and the password manager extension's autofill behavior. While the sandbox restricts many dangerous capabilities, it does not prevent scripts from reading form field values that the extension has populated.

Detection Methods for CVE-2025-65203

Indicators of Compromise

• Unexpected credential autofill prompts appearing on websites with sandboxed iframes
• Browser network logs showing credential-like data being transmitted to unknown domains
• Unusual form submissions from sandboxed iframe contexts
• KeePassXC-Browser activity logs showing autofill events for unfamiliar or suspicious domains

Detection Strategies

• Monitor browser extension activity for autofill operations targeting sandboxed iframe contexts
• Implement network monitoring to detect credential exfiltration patterns following form autofill events
• Review browser console logs for CSP violations that may indicate exploitation attempts
• Audit KeePassXC-Browser access logs for credential retrieval events that don't correspond to legitimate user authentication

Monitoring Recommendations

• Enable verbose logging in KeePassXC-Browser to track all autofill operations
• Deploy endpoint detection rules to alert on suspicious form submission patterns
• Monitor for newly added sandboxed iframes on frequently visited websites
• Implement web application firewalls to detect malicious iframe injection attempts

How to Mitigate CVE-2025-65203

Immediate Actions Required

• Update KeePassXC-Browser to the latest version that includes the security fix
• Temporarily disable automatic autofill and switch to manual credential entry until patched
• Review recently visited websites for potential credential exposure
• Rotate credentials for sensitive accounts that may have been exposed
• Enable KeePassXC-Browser's domain matching strictness settings

Patch Information

The KeePassXC development team has addressed this vulnerability through a pull request on GitHub. Users should update their KeePassXC-Browser extension to the latest available version that incorporates this fix. The patch implements proper security context validation to prevent credential autofill into sandboxed iframes and documents with restrictive CSP policies.

For technical details about the vulnerability discovery, refer to the GitHub issue discussion.

Workarounds

• Disable automatic credential autofill in KeePassXC-Browser settings and use manual copy-paste for credentials
• Configure KeePassXC-Browser to require explicit user confirmation before any autofill operation
• Use site-specific settings to restrict autofill to known, trusted domains only
• Consider temporarily disabling the extension on untrusted websites until the update is applied

# Configuration recommendations for KeePassXC-Browser
# Access extension settings and apply these configurations:

# 1. Disable automatic autofill (require manual trigger)
# Settings > General > Uncheck "Automatically fill in credentials"

# 2. Enable strict domain matching
# Settings > Advanced > Check "Match URL strictly"

# 3. Require user interaction for all operations
# Settings > General > Check "Require prompt before filling credentials"