Well. This is not a good week for lastpass.

And for all the users of password managers which use a browser extension or a cloud synced database, KeepPassXC[1] is a good alternative, because it won't come close to touching your browser or any remote server. It is cross platform so you have no excuse. It also has a mobile app which is not made by the same developers but a different company so I would be wary of the app.

[1]:https://keepassxc.org/

I'm really surprised, and disappointed, that Travis announced this publicly like this. From my understanding the Google team has a policy of giving people time to patch the bug before announcing it. I know that the technical details weren't released by by confirming there is a zero day exploit he's making it more likely to be discovered and exploited. The responsible thing would have been to notify the vendor and apply the standard policy they have in place for disclosure.