Vulnerability · Published Jun 12, 2026 · Assigned by GEN
CVE-2026-12068Avira Password Manager credential disclosure via cross-origin autofill in Firefox
High 7.4
In plain English
A high-severity security flaw in Avira Password Manager from Gen Digital. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.3%top 81.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection. This issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Gen Digital | Avira Password Manager | * |
Weakness: CWE-669 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N