Modern password-managers are moving towards a "fully-in-the-browser" model (see: historical RCE on LastPass, and now 1Password is also moving towards 1Password X as "the future" and no longer adding new features to the non-browser-extension version of their products).

Several sources indicate that using other browser-extensions alongside your password-manager-extension is a security risk; i.e. 1Password X's own:

Protect yourself when using 1Password X

  • Limit your use of other browser extensions. A malicious or badly made browser extension could interfere with 1Password X or attempt to expose your data. If you need to use untrusted extensions, consider using a separate browser profile just for 1Password X.

What are the risks in using security-critical browser extensions (password-manager, etc) alongside unverified, beta, or possibly-malicious extensions? How can one mitigate those risks without avoiding using extensions entirely?

  • Using untrusted extensions is going to be a security risk, no matter whether you use a password manager of any kind or not. Extensions can inject code on the frontend of every website, and that would enough for a lot of damage.
    – reed
    Nov 27, 2020 at 18:15
  • @reed Yes, of course; but there's a substantial difference between "someone malicious gaining access to Tree Style Tab could access my Reddit posts" and "someone malicious gaining access to Tree Style Tab could access my SSH credentials / 2FA keys / ProtonMail authentication". Nov 27, 2020 at 18:24
  • @schroeder I'd argue that it's a different question — yes, obviously, extensions are a security-risk if you allow them blanket permissions to websites; and that's well- and widely-discussed. I'm specifically curious what a WebExtension can access in another extension's localStorage, not on a website. (= Nov 27, 2020 at 18:26


You must log in to answer this question.

Browse other questions tagged .