{"id":"CVE-2026-12068","state":"PUBLISHED","title":"Avira Password Manager credential disclosure via cross-origin autofill in Firefox","description":"Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection.\n\nThis issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux.","publishedAt":"2026-06-12T22:19:18.986Z","updatedAt":"2026-06-15T16:01:19.318Z","severity":{"score":7.4,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","source":"GEN"},"assigner":"GEN","products":["Gen Digital Avira Password Manager"],"affected":[{"vendor":"Gen Digital","product":"Avira Password Manager","defaultStatus":"affected","versions":[{"version":"*","status":"affected"}],"platforms":["Firefox","Windows","macOS","Linux"]}],"references":["https://www.gendigital.com/us/en/contact-us/security-advisories/"],"weaknesses":["CWE-669"],"ingestedAt":"2026-10-29T20:10:52.580Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/12xxx/CVE-2026-12068.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-12068","state":"PUBLISHED","datePublished":"2026-06-12T22:19:18.986Z","dateUpdated":"2026-06-15T16:01:19.318Z","assignerShortName":"GEN","assignerOrgId":"dbd8429d-f261-4b1e-94cc-ae3132817e2e","dateReserved":"2026-06-12T09:09:57.930Z"},"containers":{"cna":{"title":"Avira Password Manager credential disclosure via cross-origin autofill in Firefox","descriptions":[{"lang":"en","value":"Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection.\n\nThis issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux."}],"affected":[{"vendor":"Gen Digital","product":"Avira Password Manager","defaultStatus":"affected","versions":[{"version":"*","status":"affected"}],"platforms":["Firefox","Windows","macOS","Linux"]}],"references":[{"url":"https://www.gendigital.com/us/en/contact-us/security-advisories/"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseSeverity":"HIGH","baseScore":7.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-669","lang":"en","description":"CWE-669 Incorrect Resource Transfer Between Contexts","type":"CWE"}]}],"providerMetadata":{"shortName":"GEN","orgId":"dbd8429d-f261-4b1e-94cc-ae3132817e2e","dateUpdated":"2026-06-12T22:19:18.986Z"},"impacts":[{"capecId":"CAPEC-116","descriptions":[{"lang":"en","value":"CAPEC-116 Excavation"}]}],"solutions":[{"lang":"en","value":"Avoid triggering Avira Password Manager autofill on web pages that embed cross-origin iframes (for example advertisement frames) when using Firefox. No software update is currently planned.","supportingMedia":[{"type":"text/html","base64":false,"value":"Avoid triggering Avira Password Manager autofill on web pages that embed cross-origin iframes (for example advertisement frames) when using Firefox. <strong>No software update is currently planned.</strong>"}]}],"credits":[{"lang":"en","value":"Riccardo, an independent security researcher at TU Wien","type":"reporter"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-15T16:01:07.717925Z","id":"CVE-2026-12068","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-15T16:01:19.318Z"}}]}}}