CVE-2025-65203: keepassxc-browser · CVE-2025-65203 is a high-severity
Affects keepassxc-browserSource CVE Database V5
Not known to be exploited · CVSS 7.1 High.
Data as of 26 Oct 2026, 15:59 UTC
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 3% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 17 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHubkeepassxreboot/keepassxc-browserpkg:github/keepassxreboot/keepassxc-browserOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
- Immediately monitor for updates from KeePassXC-Browser and apply patches as soon as they become available to address CVE-2025-65203.
- Until patches are released, disable autofill features in the extension or configure it to require explicit user approval before filling credentials, especially on sites embedding sandboxed iframes.
- Implement strict Content Security Policies and iframe sandboxing with restrictive attributes (e.g., disallow scripts or forms) on internal and third-party web applications to reduce exposure.
- Educate users about the risks of autofilling credentials on untrusted or unknown websites and encourage cautious behavior regarding autofill prompts.
- Employ network monitoring and anomaly detection to identify unusual outbound traffic patterns that may indicate credential exfiltration attempts.
- Consider alternative password management solutions with more robust iframe and CSP handling until this vulnerability is resolved.
- Conduct regular security assessments and penetration tests focusing on browser extension interactions with complex web security controls to identify similar risks.
Description
CVE-2025-65203 is a high-severity vulnerability in KeePassXC-Browser versions through 1.9.9.2 that allows attacker-controlled scripts within sandboxed iframes to access autofilled credentials. The issue arises because the extension autofills or prompts to fill stored credentials into documents rendered under strict Content Security Policy (CSP) directives and iframe sandbox attributes, which normally restrict script capabilities. This flaw enables malicious scripts in sandboxed contexts to read populated form fields and exfiltrate sensitive credentials without user authorization. Exploitation requires user interaction to trigger autofill prompts but does not require prior authentication or elevated privileges. The vulnerability impacts confidentiality severely, while integrity and availability impacts are limited. No known exploits are currently reported in the wild. European organizations using KeePassXC-Browser for password management should prioritize patching once available and implement strict iframe content validation to mitigate risk.