Steps to reproduce the issue

1. Install the Bitwarden browser extension (tested with 2026.9.3 in Brave) and log in. Leave the inline autofill menu at its default setting (on).
2. In the Joomla administrator, open any dashboard (e.g. System Dashboard) and click "Add module to the dashboard".

Expected result

The "Add Module" dialog opens and stays open until the user selects a module type or closes it.

Actual result

The dialog appears for a moment and then closes on its own, and the dashboard reloads. The user can't add a module. It works normally with Bitwarden logged out or disabled.

Console trace with a message listener on the parent window:

[dlg] message FROM DIALOG https://example.test {command: 'calculateSubFramePositioning', subFrameData: {…}}
[dlg] closed
  close @ joomla-dialog.min.js
  (anonymous) @ joomla-dialog-autocreate.min.js
  postMessage
  getSubFrameOffsetsFromWindowMessage @ bootstrap-autofill-overlay.js
  AutofillInit.handleExtensionMessage @ bootstrap-autofill-overlay.js

System information (as much as possible)

Joomla 6.2 (6.2-dev), Brave on macOS, Bitwarden 2026.9.3. Independent of the server.

Additional comments

build/media_source/system/js/joomla-dialog-autocreate.es6.js closes the dialog on any message event whose source is the iframe window:

window.addEventListener('message', (message) => {
  if (message.source === (popup.getBodyContent().contentWindow || window)) {
    popup.close();
  }
});

Bitwarden's autofill overlay runs inside the iframe and calls window.parent.postMessage() to work out where the iframe sits on the page. That message passes the source check, so the dialog closes. Other extensions that inject into iframes can do the same.

Joomla's own sender (modal-content-select.es6.js) always sets data.messageType (default joomla:content-select), so the handler could ignore anything that isn't a Joomla message:

window.addEventListener('message', (message) => {
  const type = message.data && message.data.messageType;
  if (typeof type === 'string' && type.startsWith('joomla:')
    && message.source === (popup.getBodyContent().contentWindow || window)) {
    popup.close();
  }
});

Other dialogs in com_cpanel, com_menus, com_redirect and com_finder use the same data-close-on-message attribute and are likely affected the same way (not separately tested).