A researcher has tested nearly a dozen password managers and found that they were all vulnerable to clickjacking attacks.