CVE-2025-65203: 
Linux Alpine vulnerability analysis and mitigation

CVE-2025-65203 is a credential exfiltration vulnerability in the KeePassXC-Browser browser extension affecting all versions through 1.9.9.2. The extension incorrectly autofills or prompts to fill stored credentials into documents rendered under a browser-enforced Content Security Policy (CSP) sandbox directive or iframe sandbox attribute, allowing attacker-controlled scripts within the sandboxed context to access populated form fields and steal credentials. The vulnerability was reported on August 23, 2025, assigned a CVE on December 17, 2025, and patched in the 1.9.9.3 milestone. It carries a CVSS v3.1 base score of 7.1 (High) (Red Hat Advisory, GitHub Issue).

The root cause is that KeePassXC-Browser fails to respect the browser's sandbox security model when determining whether to autofill credentials. When a document is sandboxed — either via the HTML <iframe sandbox> attribute or a CSP sandbox directive — the browser strips the document's origin, setting self.origin to null. The extension correctly blocks credential filling in cross-origin iframes, but does not check for the sandboxed (null-origin) condition, treating sandboxed same-domain content as trusted. An attacker can embed a sandboxed iframe containing a login form on a malicious page; when the extension autofills credentials into that form, attacker-controlled script within the sandboxed context can read the populated field values and exfiltrate them. The fix, merged in PR #2648, adds a check for self.origin === null to block autofill in any sandboxed context. Relevant CWEs include CWE-352 (CSRF), CWE-353 (Missing Support for Integrity Check), and CWE-640 (GitHub Issue, GitHub PR).

Successful exploitation allows an attacker to silently exfiltrate stored usernames and passwords from a victim's KeePassXC password manager via a malicious webpage. The confidentiality impact is rated High, as full credential contents can be captured; integrity impact is Low, and there is no availability impact. Because the stolen credentials may grant access to other systems or services, there is meaningful potential for lateral movement or account takeover beyond the initial compromise (Red Hat Advisory, GitHub Issue).

1. Craft a malicious webpage: Create an HTML page containing a sandboxed iframe (e.g., <iframe sandbox="allow-scripts" src="/login-form.html">) that hosts a login form with username and password fields matching a target site's credential entry in the victim's KeePassXC database.
2. Host the page: Deploy the malicious page on a domain or path that the victim's KeePassXC-Browser extension associates with stored credentials, or use social engineering to direct the victim to the page.
3. Trigger autofill: When the victim visits the page, KeePassXC-Browser (versions ≤ 1.9.9.2) autofills or prompts to fill stored credentials into the sandboxed iframe's form fields, bypassing the browser's sandbox security boundary.
4. Exfiltrate credentials: Attacker-controlled JavaScript running inside the sandboxed iframe reads the populated form field values (username and password) and transmits them to an attacker-controlled server via fetch() or XMLHttpRequest(), which are permitted if allow-scripts is set in the sandbox attribute (GitHub Issue, GitHub PR).

• Network: Unexpected outbound HTTP/HTTPS requests from the browser to unknown external domains immediately after a page load, particularly carrying encoded credential-like data in POST bodies or URL parameters.
• Browser Behavior: KeePassXC-Browser autofill activity triggered on pages containing sandboxed iframes or pages served with a CSP sandbox directive, which would not normally be expected to receive autofill.
• Logs: Browser developer console or network logs showing form field population events within sandboxed iframe contexts followed by outbound fetch/XHR requests to third-party endpoints.

Users should update KeePassXC-Browser to version 1.9.9.3 or later, which includes the fix from PR #2648 that blocks autofill in any sandboxed context by checking for a null self.origin. As an interim workaround for users unable to update immediately, disabling the autofill feature in KeePassXC-Browser settings reduces exposure, though it impacts usability. Users should also exercise caution when visiting untrusted websites while the extension is active (GitHub PR, Red Hat Advisory).

The vulnerability was reported by researcher JustVraj04 via the KeePassXC-Browser GitHub issue tracker on August 23, 2025, and the maintainer (varjolintu) responded the same day with a merged fix targeting the 1.9.9.3 milestone. Red Hat tracked the CVE in their security advisory database. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregators (GitHub Issue, Red Hat Advisory).