CVE-2021-41795

CVE-2021-41795 describes an authorization bypass vulnerability in the Safari app extension bundled with 1Password for Mac versions 7.7.0 through 7.8.x before 7.8.7. A malicious webpage could exploit this to read specific 1Password vault items, including usernames, passwords, credit cards, and contact information, provided 1Password is unlocked. Rated Medium severity (CVSS 6.5), this client-side vulnerability requires user interaction (visiting a malicious page) but no further authentication. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.