What is the CVSS score of CVE-2026-12068?

CVE-2026-12068 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Avira Password Manager are affected by CVE-2026-12068?

Avira Password Manager's Firefox extension contains a critical cross-origin vulnerability that enables attackers to extract stored credentials when users visit malicious sites.

How to fix or mitigate CVE-2026-12068?

Within 24 hours: Notify all users with Avira Password Manager Firefox extension to immediately disable it and switch to alternative password managers (e.g., Bitwarden, 1Password, KeePass) with current security patches applied. Within 7 days: Conduct a security incident assessment to identify any indicators of compromise such as unauthorized account access correlated with malicious site visits; reset credentials for high-value accounts. Within 30 days: Establish a monitoring program for Avira security advisories; develop and execute a transition plan to migrate users to a patched password manager alternative.

Avira Password Manager CVE-2026-12068

EUVD-2026-36632 HIGH

Incorrect Resource Transfer Between Spheres (CWE-669)

2026-06-12 GEN

GHSA-h53c-vv76-w4w5

Information Disclosure Apple Microsoft Mozilla Avira Password Manager Gen Digital

7.4

CVSS 3.1 · Vendor: GEN

Severity by source

Vendor (GEN) PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

vuln.today AI

7.4 HIGH

Network-delivered via a malicious page, no auth needed, but requires user interaction to trigger autofill; credentials cross origin (S:C) with confidentiality-only impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (GEN).

CVSS VectorVendor: GEN

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 12, 2026 - 23:17 vuln.today

CVE Published

Jun 12, 2026 - 22:19 cve.org

HIGH 7.4

DescriptionCVE.org

Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection.

This issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux.

AnalysisAI

Cross-origin credential disclosure in Avira Password Manager's Firefox extension allows a malicious site embedding the targeted page in an iframe to harvest credentials that the extension autofills into the parent context. The flaw stems from incorrect autofill field selection and affects Windows, macOS, and Linux installations; no public exploit identified at time of analysis but the CVSS 7.4 (S:C/C:H) score reflects the cross-origin trust boundary violation.

Technical ContextAI

Avira Password Manager is a browser-integrated credential manager distributed by Gen Digital that uses a Firefox WebExtension to detect login forms and autofill stored credentials. The CWE-669 (Incorrect Resource Transfer Between Spheres) root cause indicates the extension's form-detection logic crosses the same-origin boundary, treating fields inside attacker-controlled cross-origin iframes as legitimate autofill targets for the parent page's credentials. Mozilla enforces same-origin policy at the DOM level, but extensions running with elevated privileges can inadvertently bridge origins if their field-selection heuristics walk across iframe boundaries without re-validating origin - a well-documented class of password manager weakness.

RemediationAI

Patch available per vendor advisory - update Avira Password Manager to the version published in Gen Digital's security advisories at https://www.gendigital.com/us/en/contact-us/security-advisories/; an exact fixed version is not specified in the supplied data and should be confirmed against that advisory. As a compensating control until updates propagate, disable the autofill-on-page-load behavior in Avira Password Manager and require manual click-to-fill, which prevents silent cross-origin leakage at the cost of user friction. Organizations can also enforce browser policies that block third-party iframes for sensitive domains (Content-Security-Policy frame-ancestors on managed properties), though this only protects sites you control. Temporarily switching to Firefox's built-in password manager or disabling the Avira extension entirely eliminates the exposure but loses centralized credential management.