EUVD-2026-36632
GHSA-h53c-vv76-w4w5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
DeliveryEmbed target login form in cross-origin iframe
-
ExploitUser interacts triggering autofill
-
ExecutionExtension selects attacker-controlled fields
-
PersistCredentials leak to parent origin
-
ImpactExfiltrate to attacker server
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incorrect resource transfer between spheres
|
| Exploitation Conditions | Requires (1) the victim to have Avira Password Manager installed in Firefox with credentials saved for the targeted origin, (2) the victim to visit an attacker-controlled page that successfully embeds a cross-origin iframe referencing or impersonating the targeted login form, (3) user interaction with the page sufficient to trigger autofill (UI:R in the CVSS vector), and (4) the targeted site to NOT set X-Frame-Options: DENY or CSP frame-ancestors restrictions that would block being iframed. Exploitation is limited to Firefox on Windows/macOS/Linux - other browsers and the standalone Avira app are not in scope per the description. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N paints a serious confidentiality-only picture: network-reachable, low complexity, no privileges, but requires user interaction (likely clicking or focusing a form) and produces a scope change as credentials cross origin boundaries. There is no EPSS, KEV, or POC data supplied, so real-world exploitation pressure is unknown - the only reference is a generic Gen Digital advisories index, not a CVE-specific page, which limits independent verification. Compared to typical password manager autofill bugs (e.g., historical Keepass/LastPass iframe issues), the pattern is well-understood and exploitable in principle, but practical attacks depend on the victim visiting an attacker-controlled site that successfully iframes a targeted login page - many high-value sites set X-Frame-Options/frame-ancestors which would block this, reducing the realistic attack surface. |
| Exploit ScenarioDerived | An attacker hosts a phishing or watering-hole page that embeds a victim site's login form in a hidden or visually disguised cross-origin iframe; when the user visits and interacts with the page (UI:R), Avira Password Manager autofills credentials into attacker-controlled fields that the extension incorrectly selects, and the attacker exfiltrates them via the parent frame. No public exploit is identified at time of analysis, but the attack pattern is well-known from prior password manager iframe disclosure research. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 12, 2026
Cross-origin credential disclosure in Avira Password Manager's Firefox extension allows a malicious site embedding the targeted page in an iframe to harvest credentials that the extension autofills into the parent context. The flaw stems from incorrect autofill field selection and affects Windows, macOS, and Linux installations; no public exploit identified at time of analysis but the CVSS 7.4 (S:C/C:H) score reflects the cross-origin trust boundary violation.
RemediationAI
Patch available per vendor advisory - update Avira Password Manager to the version published in Gen Digital's security advisories at https://www.gendigital.com/us/en/contact-us/security-advisories/; an exact fixed version is not specified in the supplied data and should be confirmed against that advisory. As a compensating control until updates propagate, disable the autofill-on-page-load behavior in Avira Password Manager and require manual click-to-fill, which prevents silent cross-origin leakage at the cost of user friction. Organizations can also enforce browser policies that block third-party iframes for sensitive domains (Content-Security-Policy frame-ancestors on managed properties), though this only protects sites you control. Temporarily switching to Firefox's built-in password manager or disabling the Avira extension entirely eliminates the exposure but loses centralized credential management.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Avira Password Manager is a browser-integrated credential manager distributed by Gen Digital that uses a Firefox WebExtension to detect login forms and autofill stored credentials. The CWE-669 (Incorrect Resource Transfer Between Spheres) root cause indicates the extension's form-detection logic crosses the same-origin boundary, treating fields inside attacker-controlled cross-origin iframes as legitimate autofill targets for the parent page's credentials. Mozilla enforces same-origin policy at the DOM level, but extensions running with elevated privileges can inadvertently bridge origins if their field-selection heuristics walk across iframe boundaries without re-validating origin - a well-documented class of password manager weakness.
Know when Avira Password Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Network-delivered via a malicious page, no auth needed, but requires user interaction to trigger autofill; credentials cross origin (S:C) with confidentiality-only impact.
Primary rating from Vendor (GEN).
CVSS VectorVendor: GEN
DescriptionCVE.org
Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection.
This issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux.
Executive ViewAI
Avira Password Manager's Firefox extension contains a critical cross-origin vulnerability that enables attackers to extract stored credentials when users visit malicious sites. The flaw affects password manager users across Windows, macOS, and Linux, exposing sensitive authentication data that could compromise downstream systems and accounts. This represents a significant credential supply-chain risk for organizations relying on this extension.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable Avira Password Manager Firefox extension across all user systems; (2) Migrate users to alternative password managers with current security patches applied; (3) Implement browser Content Security Policy (CSP) to restrict iframe embedding of sensitive internal applications; (4) Enable credential exposure monitoring and flag unauthorized account access attempts; (5) Implement mandatory password reset for any credentials managed within Avira Password Manager; (6) Increase frequency of privileged account access reviews.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB