A zero-day flaw in the popular password manager LastPass can be triggered by users visiting a malicious site, allowing attackers to compromise the users’s account and all the sensitive information in it.
The discovery was made by Google Project Zero researcher Tavis Ormandy who, after probing a slew of AV solutions and finding serious security holes in them, has apparently set his sights on widely used password management solutions.
Aside from that flaw, he also found “a bunch of obvious critical problems,” but responsibly chose not share publicly any more details about any of the flaws until the developers have a chance to fix them.
Full Article
