This release fixes security issues in the browser extension.
- The password picker now ignores clicks that you could not see or did not aim at.
- The picker now uses an isolated communication channel, so web pages cannot interfere with it.
- Private domain suffixes are now treated as site boundaries, keeping credentials for different sites separate.
- The relay server can now run from a Docker image and provides an endpoint for ICE servers and TURN credentials.
All changes (5)
Features
- docker image, /ice-servers and TURN credentials for the node relay (#115)
Bug Fixes
- refuse picker clicks the user can't see or didn't aim (GHSA-mvjj-4qqq-xr7h)
- move the picker iframe's bridge onto a private port (GHSA-mvjj-4qqq-xr7h)
- keep private PSL suffixes as site boundaries (GHSA-rf5w-r5j3-6wmf)
Other
- chore(deps): patch dev and build tooling advisories
Full Changelog: 1.30.1-chromium...1.31.0-chromium