Clickjacking: Zoho Vault's Response

Clickjacking: Zoho Vault's Response

Issue

Password manager browser extensions are found vulnerable to clickjacking security vulnerabilities that could lead attackers to steal account credentials, TFA codes, card details, under certain conditions.

Reported by

Marek Toth, Independent Security Researcher in DEF CON 33 on August 18, 2025.

How does it impact Zoho Vault?

  1. Zoho Vault browser extension will not automatically auto-fill login credentials
  2. It will auto-fill login credentials based on user interaction
  3. For example: when a user lands on xxx.google.com, Zoho Vault browser extension will list down all the passwords matching google.com and the user should manually click on the right account to login
  4. By this way, we had minimal impact on login credentials for clickjacking

Steps taken by Zoho Vault:

  1. Our team identified this vulnerability via news on August 20, 2025
  2. On the same day, our team started working on the hot fix for all the browser extensions and uploaded it to the respective browser stores on August 23, 2025
  3. It was reviewed by the respective stores and released as below:
    1. Firefox: August 23, 2025
    2. Edge: August 24, 2025
    3. Chrome: August 25, 2025
    4. Safari: August 26, 2025
  4. Users will be automatically moved to the latest version of the browser extension
  5. We have been transparent with our users about the reported issue and have updated them throughout this period

What is fixed?

  1. Fake websites can no longer load Zoho Vault browser extensions' automatically
  2. Fake websites can no longer hide or alter the visibility of Zoho Vault browser extensions
At Zoho, we care about our user's security and privacy. If you have any questions regarding this issue or need any assistance, write to support@zohovault.com.
    • Sticky Posts

    • Introducing SecureForms in Zoho Vault

      Hey everyone, Let’s face it—asking someone to send over a password or other sensitive data is rarely straightforward. You wait. You nudge. You follow up once, twice—maybe more. And when the information finally arrives, it shows up in the worst possible
    • Join our World Password and Passkey Day expert Q&A 2025

      Hey everyone! World Password and Passkey Day is almost here, and there's no better time to talk about something we all rely on daily—secure authentication. Did you know that a staggering 60% of hacking-related breaches are tied to weak or stolen passwords?
    • Zoho Vault: A look at what's new for iOS, iPadOS, and macOS

      Hi everyone, At Zoho Vault, we constantly aim to improve your security experience. Based on both internal and external feedback, we have recently rolled out updates across our iOS, iPadOS, and support for macOS platforms. Introducing the desktop app for
    • iOS 12 update: Introducing autofill passwords and Siri Shortcuts in Zoho Vault

      With this iOS 12 release, Zoho Vault users can now autofill usernames and passwords on Safari and other third-party apps. Users can enjoy a seamless login experience to their everyday apps without compromising security and also access passwords stored in Zoho vault with Siri Shortcuts by adding personalized phrases. How to enable autofill password on your iOS device? First, you need to update your device to iOS 12.  Apple recommends you to take a backup before you update your device to the latest
      • Recent Topics

      • Ask the Experts 23: Customize, utilize, and personalize with Zoho Desk

        Hello everyone! It's time for the next round of Ask the Experts (ATE). This month is all about giving Zoho Desk a complete makeover and making it truly yours. Rebrand Zoho Desk with your organization’s details, customize ticket settings based on your
      • Dear Zoho CEO: Business Growth is about how you prioritise!

        All of us in business know that when you get your priorities right, your business grows. Zoho CRM and Zoho Books are excellent products, but sadly, Zoho Inventory continues to lag behind. Just this morning, I received yet another one-sided email about
      • Payroll In Canada

        Hi, When can we expect to have payroll in Canada with books 
      • Please review and re-enable outgoing emails for my domain

        Hello Zoho Support, I have recently purchased a new domain and set up email hosting with Zoho. However, my account shows "Outgoing Email Blocked". I am a genuine user and not sending bulk/spam emails. Please review and re-enable outgoing emails for my
      • Payroll without tax integrations (i.e. payroll for international)

        It seems as though Zoho waits to develop integrations with local tax authorities before offering Zoho Payroll to Zoho customers in a country. Please reconsider this approach. We are happy Zoho Books customers, but unhappy that we have to run payroll in
      • goingout e mail block

        info@ozanrade.com.tr
      • Incoming mails blocked

        Zoho User ID : 60005368884 My mail Id is marketing#axisformingtechnology.com .I am getting following message "Your Incoming has been blocked and the emails will not be fetched in your Zoho account and POP Accounts. Click here to get unblocked." Please
      • Assistance Needed: Ticket Status Not Updating and Sorting by Last Customer Reply in Zoho Desk

        Hello, I’m facing two issues in Zoho Desk that I’d like your guidance on: Ticket Status Not Updating: When a customer replies to a ticket, the status does not change to Reopened. Instead, it remains in Waiting on Customer, even after the customer’s response
      • Configuring Email Notifications with Tautulli for Plex

        Hi I'm new to Zoho. I am from Canada and I have a I use a web based application called Tautulli for Plex that monitors my Plex media server. It also sends a newsletter to my followers. To set this up they require a "From" email address., a smtp server
      • Is there a way to automatically add Secondary Contacts (CCs) when creating a new ticket for specific customers?

        Some of our customers want multiple contacts to receive all notifications from our support team. Is there a way to automatically add secondary contacts to a ticket when our support team opens a new ticket and associates it with an account? This would
      • How to Set Up Zoho Mail Without Cloudflare on My Website

        I'm having some trouble with Cloudflare here in Pakistan. I want to configure Zoho Mail for my domain, but I'm not sure how to set it up without going through Cloudflare. My website, https://getcrunchyrollapk.com/ , is currently using CF, but I'd like
      • Spam is Being Forwarded

        I am filtering a certain sender directly to the Trash folder. Those messages are still being forwarded. Is this supposed to happen?
      • IMAP Block

        My two accounts have been blocked and I am not able to unblocked them myself. Please respond to email, I am traveling and this is urgent.
      • "DKIM not configured"

        Hello. I have been attempting get the DKIM verified but Toolkit keeps sending the message that it is not configured, but both Namecheap and Zoho show it as configured properly. What am I missing?
      • Zoho mail with custom domain not receiving email

        i registered zoho mail with my own domain. I can login and access the mail app. I tried to send email from an outlook email account and an icloud email account. Both emails were not received. My plan is free. I also tried to send email from this zoho
      • Set connection link name from variable in invokeurl

        Hi, guys. How to set in parameter "connection" a variable, instead of a string. connectionLinkName = manager.get('connectionLinkName').toString(); response = invokeurl [ url :"https://www.googleapis.com/calendar/v3/freeBusy" type :POST parameters:requestParams.toString()
      • Waterfall Chart

        Hello, I would like to create a waterfall chart on Zoho analytics which shows the movement in changes of budget throughout a few months, on a weekly basis. Should look something like the picture below. Does anyone know how to?
      • Help Center and SEO: Any Benefit to My Domain-Mapped Website Ranking?

        First of, I love the Help Center which I've just decided to integrate into my website to replace its old-fashioned FAQs. So much more to achieve there now! Lots of new benefits to the site visitors and to me in terms of organizing and delivering all the
      • Issue with Importing Notes against Leads

        Hi, I am attempting to import some Notes into Zoho CRM which need to be assigned to various Leads. I have created a csv file which I am testing that contains just one record. This csv file contains the following columns: Note Id Parent Id       (I have
      • Trigger a Workflow Function if an Attachment (Related List) has been added

        Hello, I have a Case Module with a related list which is Attachment. I want to trigger a workflow if I added an attachment. I've seen some topics about this in zoho community that was posted few months ago and based on the answers, there is no trigger
      • Option to Hide Project Overview for Client Profiles

        In Zoho Projects, the Project Overview section is currently visible to client profiles by default. While user profiles already have the option to restrict or hide access to the project overview, the same flexibility isn’t available for client profiles.
      • Creator Add Records through API - Workflows not triggered ?

        Hi Everyone, I am trying to add records to my Creator application through a third party app that I am developing. Currently, I am testing this through Postman. The records I need to add have a lot of workflows to run to populate dropdowns, fields, use
      • Zoho Books Idea - Include another field in Bank Details for Address

        Hi Books team, Currently use the Description field in the Bank Details to store the bank's address. This works fine but it would be great if you could add another field for Bank Address, so that other notes about the bank account could be stored in the
      • Zoho Books Idea - Bank Details Button on Banking

        Hi Books team, Sometimes I'm asked to share bank details with a customer or a colleague. So I go to the Banking Module, find the correct bank account, click Setting > Edit, then copy and paste the bank details. Wouldn't it be great if there was a button
      • Zoho Error: This Operation has been restricted. Please contact support-as@zohocorp.com for further details

        Hello There, l tried to verify my domain (florindagoreti.com.br) and its shows this error: This Operation has been restricted. Please contact support-as@zohocorp.com for further details. Screenshot Given Below -  please check what went wrong. Thanks
      • Important Update: Changes to Google Translate Support in Zoho SalesIQ

        We’re updating our default chat translation options across all Zoho SalesIQ data centres to offer a more secure, in-house solution for your translation needs. What’s changing? We will be offering Zoho Translate (our in-house tool) as the default translation
      • FSM Improvement Idea - Show an Import button when there is no data

        I am setting up FSM for a client and I noticed that there is no option to import data, see screenshot below. Even when you click Create Contact there is only an option to Import from Zoho Invoice. It is only after you add at lease 1 record that the Import
      • Zoho CRM Community Digest - July P1 | 2025

        Hey everyone, The start of July 2025 marked a special milestone: 200 posts in our Kaizen series! For those new here, Kaizen is a go-to series for Zoho CRM developers, where we regularly share best practices, tips, and expert insights to help you build
      • can't login Kiosk URGENT

        already try, can't login pls help to support. thanks.
      • Join our BI & Analytics Workshop at Zoholics UK 🇬🇧

        Hello users, We are thrilled to announce a hands-on workshop at Zoholics UK, 2025, led by Ashwinth and Alan, our Product Experts. This session is designed for anyone who wants to move beyond raw data and truly understand their business performance using
      • What’s New in Zoho Expense (April – July 2025)

        Hello users, We're happy to bring you the latest updates and enhancements we've made to Zoho Expense over the past three months, which include introducing the Trip Expense Summary report in Analytics, extending Chatbot support to more editions, rolling
      • Nimble enhancements to WhatsApp for Business integration in Zoho CRM: Enjoy context and clarity in business messaging

        Dear Customers, We hope you're well! WhatsApp for business is a renowned business messaging platform that takes your business closer to your customers; it gives your business the power of personalized outreach. Using the WhatsApp for Business integration
      • Weekly Tips: Insert frequently used phrases in a jiffy using Hotkeys

        You often find yourself using similar phrases in an email —like confirming appointments or providing standard information. Constantly switching between the mouse and keyboard interrupts your flow and slows you down.Instead of typing the same phrases over
      • Undo Command in Notebook

        It would be handy to have an Undo in the row of icons at the bottom of the notes.
      • Improved UI for a Seamless User Experience - Calls, Tasks, and Meetings

        Hello all, We are making UI unification across CRM so that the UI experience is seamless across the product. As part of that effort, we have made changes to the details page of activity-based module records—Meetings, Calls, and Tasks. Let's look at these
      • New Customization options in the module builder: Quick Create and Detail view

        Hello everyone, We have introduced two new components to the module builder: Quick create and Detail view. The Quick Create Component It is a mini form used to create a record and associate it to the parent record from a lookup field. For example, if you have a Deals lookup in the Contacts module, then you can associate existing deals or create a deal and associate it with the contact. You can customize this Quick Create form by adding standard as well as custom fields. There is no limit to the number
      • Unable to send message; Reason:554 5.1.8 Email Outgoing Blocked

        Hi, I sent few emails and got this: Unable to send message; Reason:554 5.1.8 Email Outgoing Blocked And now I have few days since I cant send any email. Is there something wrong I did? Also can someone fix this please
      • Cross References Do Not Update Correctly

        I am using cross references to reference Figures and current am just using the label and number, i.e. Figure #. As seen here: When I need to update the field, I use the update field button. But it will change the cross reference to no longer only including
      • Add multiple users to a task

        When I´m assigning a task it is almost always related to more than one person. Practical situation: When a client request some improvement the related department opens the task with the situation and people related to it as the client itself, the salesman
      • Narrative 9: GC—Meaningful conversations that benefit your customers

        Behind the scenes of a successful ticketing system - BTS Series Narrative 9: GC—Meaningful conversations that benefit your customers Customers often seek immediate solutions, which is why self-service options are essential. Guided Conversations provides
      • Next Page