This release fixes two security issues in the browser extension.
- The password picker now ignores clicks that are not visible on screen or that you did not aim at.
- The password picker now communicates over a private connection.
- The extension now respects private public suffix list entries as site boundaries.
- The relay is available as a Docker image and can provide ICE server and TURN credentials.
All changes (5)
Features
- docker image, /ice-servers and TURN credentials for the node relay (#115)
Bug Fixes
- refuse picker clicks the user can't see or didn't aim (GHSA-mvjj-4qqq-xr7h)
- move the picker iframe's bridge onto a private port (GHSA-mvjj-4qqq-xr7h)
- keep private PSL suffixes as site boundaries (GHSA-rf5w-r5j3-6wmf)
Other
- chore(deps): patch dev and build tooling advisories
Full Changelog: 1.27.1-firefox...1.28.0-firefox