CVE-2026-12068

Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection. This issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.gendigital.com/us/en/contact-us/security-advisories/

Configurations

No configuration.

History

23 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de revelación de información en Avira Password Manager cuando se usa con Mozilla Firefox puede permitir a un atacante remoto que opera un iframe de origen cruzado obtener credenciales autorrellenadas para la página web principal mediante una selección incorrecta del campo de autorrelleno. Este problema afecta a Avira Password Manager cuando se usa con Mozilla Firefox en Windows, macOS y Linux.

12 Jun 2026, 23:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-12 23:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-12068

Mitre link : CVE-2026-12068

CVE.ORG link : CVE-2026-12068

JSON object : View

Products Affected

No product.

CWE

CWE-669

Incorrect Resource Transfer Between Spheres

{"id": "CVE-2026-12068", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12068", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T16:01:07.717925Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@nortonlifelock.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@nortonlifelock.com", "affectedData": [{"vendor": "Gen Digital", "product": "Avira Password Manager", "versions": [{"status": "affected", "version": "*"}], "platforms": ["Firefox", "Windows", "macOS", "Linux"], "defaultStatus": "affected"}]}], "published": "2026-06-12T23:16:33.553", "references": [{"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/", "source": "security@nortonlifelock.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@nortonlifelock.com", "description": [{"lang": "en", "value": "CWE-669"}]}], "descriptions": [{"lang": "en", "value": "Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection.\n\nThis issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux."}, {"lang": "es", "value": "Vulnerabilidad de revelaci\u00f3n de informaci\u00f3n en Avira Password Manager cuando se usa con Mozilla Firefox puede permitir a un atacante remoto que opera un iframe de origen cruzado obtener credenciales autorrellenadas para la p\u00e1gina web principal mediante una selecci\u00f3n incorrecta del campo de autorrelleno.\n\nEste problema afecta a Avira Password Manager cuando se usa con Mozilla Firefox en Windows, macOS y Linux."}], "lastModified": "2026-07-23T09:10:00.113", "sourceIdentifier": "security@nortonlifelock.com"}