CVE-2026-12068: Avira Password Manager credential disclosure via cross-origin autofill in Firefox

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-12 · updated 2026-07-23
Weakness: CWE-669

Description

Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection. This issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux.

Affected products

Gen Digital Avira Password Manager: all versions

References

https://www.gendigital.com/us/en/contact-us/security-advisories/

Get alerted when CVE-2026-12068 or the next vulnerability affects your stack