Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

css variables are leaked into the document from the extension #1340

Closed
brecert opened this issue Jun 1, 2021 · 0 comments · Fixed by #1386
Closed

css variables are leaked into the document from the extension #1340

brecert opened this issue Jun 1, 2021 · 0 comments · Fixed by #1386
Labels
PR pending A pull request for this feature or fix has been made security

Comments

@brecert
Copy link

brecert commented Jun 1, 2021 •
edited
Loading

Current Behavior

Currently, keepassxc-browsers's CSS variables leak into the document, making it possible to detect and fingerprint on whether or not keepassxc-browser is installed.

Expected Behavior

CSS variables should not leak into the document, preventing fingerprinting.

Steps to Reproduce

Demonstration

getComputedStyle(document.body).getPropertyValue('--kpxc-background-color')

Debug Info

KeePassXC - 2.6.4
KeePassXC-Browser - 1.7.8.1
Operating system: Linux - NixOS
Browser: Tested with Firefox & Chromium
@varjolintu varjolintu added the PR pending A pull request for this feature or fix has been made label Aug 1, 2021
@varjolintu varjolintu mentioned this issue Aug 1, 2021
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
PR pending A pull request for this feature or fix has been made security
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Prevent CSS leaking keepassxreboot/keepassxc-browser
2 participants
@brecert @varjolintu