CVE-2025-65203: CSRF
Published Dec 17, 2025
·Updated
KeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill stored credentials into documents rendered under a browser-enforced CSP directive and iframe attribute sandbox, allowing attacker-controlled script in the sandboxed document to access populated form fields and exfiltrate credentials.
Affected Software
2 affected components
KeePassXC KeePassXC-Browser<=1.9.9.2
KeePassXC KeePassXC-Browser<=1.9.9.2
Remediation
Event History
Dec 17, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·06:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-65203?
CVE-2025-65203 is classified as a medium severity vulnerability.
2
How do I fix CVE-2025-65203?
To mitigate CVE-2025-65203, upgrade the KeePassXC-Browser to version 1.9.9.3 or later.
3
What impact does CVE-2025-65203 have on my credentials?
CVE-2025-65203 allows attacker-controlled scripts to potentially access and exfiltrate your stored credentials.
4
In which software versions is CVE-2025-65203 present?
CVE-2025-65203 affects KeePassXC-Browser versions up to and including 1.9.9.2.
5
What types of attacks are possible due to CVE-2025-65203?
CVE-2025-65203 can enable credential theft via malicious scripts in sandboxed documents.