CVE-2021-41795: 
NixOS vulnerability analysis and mitigation

The Safari app extension bundled with 1Password for Mac versions 7.7.0 through 7.8.x before 7.8.7 was affected by an authorization bypass vulnerability (CVE-2021-41795). The vulnerability was discovered and responsibly disclosed by a security researcher known as Megamind, and was fixed in version 7.8.7 (1Password Support).

The vulnerability allowed a malicious web page to bypass authorization controls and read a subset of 1Password vault items that would normally be fillable by the user on that web page. The affected items included usernames and passwords for vault items associated with the malicious domain, usernames and passwords without domain associations, credit cards, and contact items. The vulnerability could only be exploited when 1Password was unlocked, though no further user interaction was required (CVE Mitre).

The impact was limited to unauthorized access of specific vault items when 1Password was unlocked. A malicious website could only access login credentials associated with its own domain or those without domain associations, along with identity and credit card information. Importantly, the attacker could not access login credentials associated with other domains (1Password Support).

Users of affected versions of 1Password for Mac were advised to update to version 7.8.7 or later, which resolved the vulnerability. The issue did not affect 1Password in other browsers, on other platforms, or 1Password 8 (1Password Support).