Allan Feldman 83c6ae33dc Fix security bug which autofilled passwords without passcode/faceid auth ...

The autofill extension currently calls the success callback even if a
passcode/FaceID is not successfully verified.

In the case that the PGP key passphrase is stored, this results in
password decryption without further user interaction.

The fix is to only decrypt passwords upon successful passcode / FaceID
verification.

2023-03-09 12:55:39 -08:00

1014 B

Raw Permalink Blame History

View Raw