1Password users on Mac urged to apply patch

  Mac users of 1Pasword version 8.10.36 are urged to apply a patch to prevent attackers from stealing entire password vaults.

“To exploit the issue, an attacker must run malicious software on a computer specifically targeting 1Password for Mac. An attacker is able to misuse missing macOS-specific inter-process validations to hijack or impersonate a trusted 1Password integration such as the 1Password browser extension or CLI.”

This would permit the malicious software to exfiltrate vault items, as well as obtain derived values used to sign in to 1Password, specifically the account unlock key and “SRP-𝑥”.”

 Advisory