A critical vulnerability has been discovered in a password manager bundled with Windows 10 that could allow any website to steal any password stored on a personal computer.

Discovered by Google Project Zero researcher Travis Ormandy, the bug in the Keeper Password Manager was found in a new copy of Windows 10 downloaded from Microsoft Developer Network. It should be noted that although Keeper itself has previously been offered as an optional download for Windows users via the Windows Store, it has only recently been bundled with Windows 10 installations as standard.

Ormandy found that a browser plug-in that Keeper prompted him to enable injects privileged User Interface data via content script into unreliable pages. That makes the data, which includes password information, accessible by websites run by malicious actors. Worse still, Ormandy said, he had reported the same vulnerability 16 months ago in the nonbundled version of Keeper, meaning that in that time nothing had been done to fix it.

Reacting bizarrely to the report, the company behind the vulnerability, Keeper Security Inc., asked Ormandy to change his vulnerability disclosure.

“Keeper sent me a mail requesting multiple changes to this report, the crux of their concern is that they believe the Keeper browser extension is a separate product to their Keeper desktop application and believe this report conflates the two products,” Ormandy wrote last Thursday. “The keeper browser extension is installed as part of the default setup flow for the Keeper application … Unless a user clicks ‘Skip’ in this dialog, they would be affected by this vulnerability. I stand by my original assessment of this issue, and consider clicking ‘Skip’ here a non-default configuration.”

Keeper Security has not publicly commented on the report, with neither the company’s Twitter page not its blog mentioning it as of 11 p.m. EST Sunday.

It’s not clear how many users may be exposed to the critical vulnerability in Keeper given it has only recently been bundled with Windows 10. But the fact that Microsoft has pushed third-party software on users that exposes their password data to potential theft is not a good look for a company that has made strong strides in attempting to offer a more secure computing experience.

Image: Keeper/Windows Store