CVE-2026-12068: Avira Password Manager credential disclosure via cross-origin autofill in Firefox
Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection.
This issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable Avira Password Manager autofill in the Firefox extension (turn off automatic form filling) or disable the autofill feature for accounts/passwords in the extension settings to prevent automatic credential population.
Avira Password Manager (Firefox) autofill = disabled - Compensating control
Avoid triggering Avira Password Manager autofill on web pages that embed cross-origin iframes (for example advertisement frames) when using Firefox. Where possible, do not use autofill on pages containing cross-origin iframes or remove/block such iframes on pages that collect credentials.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12068?
CVE-2026-12068 has a high severity rating of 7.4.
How do I fix CVE-2026-12068?
To mitigate CVE-2026-12068, avoid triggering Avira Password Manager autofill on web pages with cross-origin iframes when using Firefox.
What causes CVE-2026-12068?
CVE-2026-12068 is caused by incorrect autofill field selection in Avira Password Manager when a cross-origin iframe is present.
Who is affected by CVE-2026-12068?
CVE-2026-12068 affects users of Avira Password Manager when used in conjunction with Mozilla Firefox.
What types of attacks can CVE-2026-12068 facilitate?
CVE-2026-12068 can facilitate information disclosure attacks, allowing remote attackers to obtain sensitive credentials.