CVE-2026-12068

Deferred Deferred - Pending Action

Information Disclosure in Avira Password Manager via Firefox Autofill

Publication date: 2026-06-12

Last updated on: 2026-06-15

Assigner: NortonLifeLock Inc.

Description

Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection. This issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-12

Last Modified

2026-06-15

Generated

2026-07-03

AI Q&A

2026-06-13

EPSS Evaluated

2026-07-01

NVD

CVE-2026-12068

EUVD

EUVD-2026-36632

Affected Vendors & Products

Vendor	Product	Version / Range
avira	password_manager	*
mozilla	firefox	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-669	The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

Attack-Flow Graph

Executive Summary

This vulnerability is an information disclosure issue in Avira Password Manager when it is used with Mozilla Firefox. A remote attacker can exploit this by operating a cross-origin iframe, which allows them to access credentials that were autofilled for the parent web page. The problem arises due to incorrect autofill field selection.

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive credentials autofilled by Avira Password Manager in Mozilla Firefox. This means an attacker could potentially steal your login information for websites, compromising your accounts and personal data.

Compliance Impact

The vulnerability allows a remote attacker to obtain credentials autofilled for the parent web page via a cross-origin iframe due to incorrect autofill field selection in Avira Password Manager when used with Mozilla Firefox. This information disclosure could lead to unauthorized access to sensitive personal or protected health information.

Such unauthorized disclosure of credentials may impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and disclosure.

Hi! I’m here to help you understand CVE-2026-12068. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70