![](/static/253f0d9b/assets/icons/icon-96x96.png)
![](https://sh.itjust.works/pictrs/image/c38fd5ff-821e-45c9-b2ee-957d0321d2e2.webp)
Yeah, it sounds like the first exploit required your vault to be unlocked so that a malicious process pretending to be a legitimate integration like a browser plugin could request credentials, and the second one required installing an out of date version of the app.
Good that it is all patched, and that it wasn’t a remotely exploitable issue.
One thing to keep in mind about how these vaults work, is you often unlock them and then they stay unlocked for a short period of time, like 5 minutes. So if you do compromise a system and can detect when it is unlocked, you have a decent window to programmatically extract credentials.
That said, it requires that your system has already been completely owned, pretty much. At that point, it could potentially log keystrokes and clipboard, and get credentials, including your master password.