A malicious website could ask the N-able Passportal browser extension for authentication tokens and receive enough access to enumerate, decrypt and modify credentials across a password vault. The vulnerable extension did not require the attacker to compromise N-able, the managed…