However, if improperly implemented, a malicious website can abuse this to steal a user's password. The main cause of such vulnerabilities is that the JavaScript environment of a malicious website cannot be trusted.[5] User Interface flaws: Some password managers will ask the user to log in through an iframe. This can present a security risk because it trains the user to fill in their password while the URL displayed by the browser is not the one of the password manager.