← Back to blog
·7 min read

How Browser Extensions Can Steal Your Passwords — And How SandPass Prevents It

Browser extensions are powerful — they can read and modify every page you visit, intercept network requests, and access sensitive data. This makes password manager extensions both incredibly useful and potentially dangerous. Here's how SandPass's security model handles this responsibility.

The Attack Surface

A typical browser extension has access to:

  • Page content: Every DOM element, every form field, every piece of text on any website you visit
  • Network requests: Extensions can intercept, modify, or block HTTP requests
  • Storage: Local storage, cookies, and IndexedDB data
  • Clipboard: Read and write to the system clipboard

This means a malicious extension — or a compromised legitimate one — could steal every password you type, even without a password manager.

How Most Password Managers Inject Credentials

Most password managers inject an autofill dropdown directly into the page DOM. This creates vulnerabilities:

  • DOM sniffing: The website's JavaScript can observe DOM mutations and read injected credential values
  • CSS attacks: Clever CSS can make invisible elements that capture autofilled data
  • Event listeners: The page can listen for input events to capture filled values

SandPass's Closed Shadow DOM

SandPass renders its autofill dropdown inside a closed Shadow DOM. This is a browser-native isolation mechanism that prevents:

  • The host page from accessing the Shadow DOM's internal structure
  • CSS from the page from affecting the dropdown's appearance
  • JavaScript from the page from reading credential values before they're placed in form fields

No other major password manager currently uses closed Shadow DOM for autofill. Most use open Shadow DOM or no isolation at all.

Content Security Policy

SandPass enforces a strict CSP:

script-src 'self' 'wasm-unsafe-eval'; object-src 'none'

This means:

  • No inline scripts can execute (prevents XSS)
  • No external scripts can be loaded (prevents supply chain attacks)
  • WASM is allowed only for Argon2id and OPAQUE computations
  • No plugins or embedded objects

Domain Verification (Phishing Protection)

Before autofilling credentials, SandPass verifies that the current website's domain matches the stored credential's domain using eTLD+1 matching. This means:

  • login.google.com matches credentials stored for google.com
  • google.evil-site.com does NOT match
  • g00gle.com (typosquatting) does NOT match

Non-Extractable Cryptographic Keys

SandPass uses the Web Crypto API with extractable: false for all cryptographic keys. This means:

  • Keys exist only inside the browser's secure key store
  • Even the extension's own JavaScript cannot export the raw key bytes
  • A compromised content script cannot steal the encryption key
  • Keys are bound to the browser profile and cannot be cloned

Extension Permissions

SandPass requests only the minimum permissions needed:

  • activeTab — access only the current tab, only when the user interacts
  • storage — for encrypted local vault cache
  • alarms — for TOTP countdown and session timeout

We don't request webRequest, history, bookmarks, or any permission that would allow broad surveillance.

What You Can Do

  1. Audit your extensions. Go to chrome://extensions and review what permissions each extension has
  2. Remove unused extensions. Every extension is an attack surface
  3. Use a password manager that takes isolation seriously. Look for Shadow DOM usage, strict CSP, and minimal permissions

Your password manager is the most security-critical extension in your browser. It should be held to the highest standard.