Zero day hole can pwn millions of LastPass users, all that's needed is a malicious site

Remote 'complete account compromise' possible, Google hacker finds

A dangerous zero-day vulnerability has been found in popular cloud password vault LastPass, which The Register has been told can completely compromise user accounts."