The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to leakage of PIA proxy credentials when a user visits any malicious website that issues a Basic auth challenge. This issue was fixed in version 3.2.5, but reintroduced in later versions.
A user must visit a malicious website that issues a Basic authentication challenge. The unguarded onAuthRequired handler can then disclose the PIA proxy credentials.
Firefox users with an affected version of the Private Internet Access Extension installed are exposed when they visit a website controlled by an attacker that presents a Basic auth challenge.
Version 3.2.5 fixed the issue, but it was reintroduced in later versions. The provided information does not identify which later versions are affected or a currently fixed version.
Avoid using the affected extension when visiting untrusted sites, since a malicious site can trigger the leak through a Basic auth challenge. The provided information does not specify another configuration-based workaround.