# Kaspersky Password Manager allows websites to access user's address data

Kaspersky Password Manager injects its UI into untrusted pages without isolation, letting any website script it to read stored addresses and deanonymize users.

- Payout: hidden
- Severity: medium
- Program: Kaspersky
- Found by: palant
- Disclosed: 2019-11-24
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/430854
- Library page: https://bugbountylibrary.com/r/h1%3A430854
- Tags: area:os domain:browser impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:medium tech:firefox technique:js-analysis vuln:info-disclosure

**Target:** Browser extension UI injected into web pages
**Root cause:** The password manager injects its autofill UI into untrusted web pages with no isolation, so page scripts can instrument the injected UI and trigger address filling without user consent.
**Steps:**
1. Unlock Kaspersky Password Manager and add a single-line address entry.
2. Host the PoC extract_address.html on any web server (localhost works).
3. Visit the page in Firefox 62 (or Chrome) and wait a few seconds.
4. An alert pops up showing the user's name and address read from the vault.
**How found:** Researcher noticed the extension injects its UI directly into untrusted pages with no protections, hypothesizing page scripts could instrument that UI to trigger autofill and read the values.
**Exploitation:** A malicious page loads the PoC, which scripts the injected Kaspersky UI to fill the stored address into page-controlled fields, then reads the values and could exfiltrate them to a third party silently.
**Insight:** Password manager extensions that render autofill UI in-page without shadow DOM/iframe isolation are scriptable by the host page; test whether page JS can trigger fill and read the resulting field values.