Password manager LastPass has fixed a serious vulnerability in its browser extensions for Google Chrome, Mozilla Firefox, and Microsoft Edge. The flaw was discovered by Google's Tavis Ormandy, reports Network World. It could have been exploited to access extensions' internal commands and steal passwords or personal information.
LastPass has put a workaround in place to provide protection from malicious codes and plans to fully fix the flaw in updated versions.
Ormandy later reported another vulnerability in the Firefox extension, which LastPass said was linked to the first. The problem was immediately fixed in a new version of the extension 4.1.36a released the next day.
"No password changes are required of users at this time," say LastPass developers.