Reproduction
- Use a secure origin with a passkey available to LastPass.
- Open a native HTML
<dialog>. - Start
navigator.credentials.get() and complete the passkey request with LastPass. - Immediately after the promise resolves, close and remove the page dialog, then show a username input.
Expected
The “Logging in with passkey...” panel should close after successful authentication.
Actual
The panel remains visible after the page dialog closes and is removed. DevTools showed the prompt iframe inside LastPass's closed shadow root.
Extension source clue
LastPass Firefox 4.141.0, web-client-content-script.js (minified), in the passkey prompt path:
t.passkeyLoggingInPrompt
f = document.querySelector("dialog[open]")
f && { container: f }
data-automation-id="tab-prompt-container"
The prompt portal selects the first open page dialog as its container.
Affected versions observed
- LastPass 4.154.2 in Opera
- LastPass 4.141.0 in Firefox
Suggested fix
Create a LastPass-owned dialog with a unique ID and target it explicitly. Do not select an arbitrary host-page dialog. Close and clean up the owned dialog when passkey authentication succeeds or is cancelled.