# Kaspersky Password Manager is vulnerable to HTML injection in the browser action pop-up via user name

Kaspersky Password Manager's popover.html failed to escape saved usernames, letting a malicious site inject HTML that spoofed the master password prompt and stole the vault password.

- Payout: hidden
- Severity: medium
- Program: Kaspersky
- Found by: palant
- Disclosed: 2018-12-24
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/435618
- Library page: https://bugbountylibrary.com/r/h1%3A435618
- Tags: area:os domain:browser impact:ato impact:data-leak kind:bounty platform:hackerone sev:medium tech:chromium tech:firefox technique:source-review vuln:info-disclosure vuln:xss

**Target:** Browser extension popover.html (browser action pop-up)
**Root cause:** popover.html renders saved user names without HTML escaping, so attacker-controlled username markup is injected into the extension's trusted UI. CSP blocks script execution but not HTML/CSS injection.
**Steps:**
1. Host `tricky_login.html`, `x.html`, `x.css` on a web server (localhost works).
2. With Kaspersky Password Manager installed and unlocked, visit `tricky_login.html`.
3. Enter credentials in the login form and submit; allow KPM to save them. The username contains trailing HTML after padding spaces so it is cut off in the save dialog display.
4. Page and KPM field icons claim an error and instruct the user to click the toolbar button.
5. Clicking the toolbar button renders the injected HTML (external stylesheet + iframe) as a spoofed master password prompt.
6. Enter the master password and click Unlock; the injected iframe/page receives it and shows `Gotcha! Your password is: ...`.
**How found:** Noticed popover.html does not escape user names; tested whether CSP would neutralize the injection, found HTML/CSS still rendered, and built a UI-spoofing PoC.
**Exploitation:** A malicious website manipulates the username it submits so KPM stores HTML payload. When the victim opens the KPM browser-action popover, the unescaped username injects an external stylesheet and iframe that perfectly mimic the master password prompt. The victim types the vault password into the attacker-controlled iframe, which exfiltrates it.
**Escalation:** CSP blocks script execution, so the attacker pivots to HTML/CSS injection plus iframe to spoof trusted UI and phish the master password.
**Insight:** In extension UIs, CSP often blocks script but not HTML/CSS injection; unescaped stored fields like usernames can still spoof trusted prompts via iframes and external stylesheets, so test HTML injection even when XSS is 'mitigated'.