CVE-2026-12068: Avira Password Manager credential disclosure via cross-origin autofill in Firefox

Synopsis

This is an information disclosure vulnerability in Avira Password Manager when used as a browser extension with Mozilla Firefox. A remote attacker who controls a cross-origin iframe embedded in a page where Avira Password Manager autofills credentials can read those autofilled credentials due to incorrect autofill field selection logic. Successful exploitation exposes the victim's username and password for the affected site to the attacker's origin. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver a page containing a cross-origin iframe to the victim over the network, so the affected service must be reachable by the victim's browser from an attacker-controlled origin.

• AuthenticationNot required

  No account or credentials on the target system are required; the attacker only needs to serve a web page the victim visits.

• Victim interactionRequired

  The victim must navigate to the attacker-controlled page and trigger autofill on a site where their credentials are stored, making this a social-engineering vector that requires the user to visit a crafted URL.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no race conditions or special environmental prerequisites beyond delivering the malicious iframe to the victim.

Blast Radius

• The attacker reads the plaintext username and password autofilled by Avira Password Manager for whatever site the victim was authenticating to at the time of exploitation.
• Captured credentials can be replayed immediately against the target site, granting the attacker full access to that account without any further exploitation steps.
• If the victim reuses the same password across multiple services, the attacker gains a credential that works beyond the immediate target site.