{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12068", "assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e", "state": "PUBLISHED", "assignerShortName": "GEN", "dateReserved": "2026-06-12T09:09:57.930Z", "datePublished": "2026-06-12T22:19:18.986Z", "dateUpdated": "2026-06-12T22:19:18.986Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e", "shortName": "GEN", "dateUpdated": "2026-06-12T22:19:18.986Z"}, "title": "Avira Password Manager credential disclosure via cross-origin autofill in Firefox", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-669", "description": "CWE-669 Incorrect Resource Transfer Between Contexts", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-116", "descriptions": [{"lang": "en", "value": "CAPEC-116 Excavation"}]}], "affected": [{"vendor": "Gen Digital", "product": "Avira Password Manager", "platforms": ["Firefox", "Windows", "macOS", "Linux"], "versions": [{"status": "affected", "version": "*"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection.\n\nThis issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection.<p>This issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux.</p>"}]}], "references": [{"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"}}], "solutions": [{"lang": "en", "value": "Avoid triggering Avira Password Manager autofill on web pages that embed cross-origin iframes (for example advertisement frames) when using Firefox. No software update is currently planned.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Avoid triggering Avira Password Manager autofill on web pages that embed cross-origin iframes (for example advertisement frames) when using Firefox. <strong>No software update is currently planned.</strong>"}]}], "credits": [{"lang": "en", "value": "Riccardo, an independent security researcher at TU Wien", "type": "reporter"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection.\n\nThis issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux."}], "id": "CVE-2026-12068", "lastModified": "2026-06-12T23:16:33.553", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.0, "source": "security@nortonlifelock.com", "type": "Secondary"}]}, "published": "2026-06-12T23:16:33.553", "references": [{"source": "security@nortonlifelock.com", "url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"}], "sourceIdentifier": "security@nortonlifelock.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-669"}], "source": "security@nortonlifelock.com", "type": "Secondary"}]}

{}