If I pop out a new window on the extension and forget to close it, the Bitwarden extension does not lock. This is easy to do, and you may not realize that you haven’t closed the pop-up, leaving your account exposed.
This help section explains the problem. “However, it’s important to note that when the browser extension is popped out, it will not adhere to your chosen vault timeout settings.”
Full help article:
The Bitwarden browser extension includes a pop-out feature that allows you to reposition the client while using your internet browser. To pop out the browser extension, you need to select the appropriate icon in the extension interface 3, 7. However, it’s important to note that when the browser extension is popped out, it will not adhere to your chosen vault timeout settings.
I see this action," not adhering to vault timeout settings," as a significant vulnerability.