Threat database

CVE-2025-65203 is a high-severity vulnerability in KeePassXC-Browser versions through 1.9.9.2 that allows attacker-controlled scripts within sandboxed iframes to access autofilled credentials. The issue arises because the extension autofills or prompts to fill stored credentials into documents rendered under strict Content Security Policy (CSP) directives and iframe sandbox attributes, which normally restrict script capabilities. This flaw enables malicious scripts in sandboxed contexts to read populated form fields and exfiltrate sensitive credentials without user authorization. Exploitation requires user interaction to trigger autofill prompts but does not require prior authentication or elevated privileges. The vulnerability impacts confidentiality severely, while integrity and availability impacts are limited. No known exploits are currently reported in the wild. European organizations using KeePassXC-Browser for password management should prioritize patching once available and implement strict iframe content validation to mitigate risk.