CVE-2026-12068 is an information disclosure vulnerability in Gen Digital's Avira Password Manager when used with Mozilla Firefox across multiple operating systems. The issue arises from incorrect resource transfer between contexts (CWE-669), specifically improper autofill field selection that allows a remote attacker operating a cross-origin iframe to access credentials autofilled for the parent page. The vulnerability has a CVSS 3.1 base score of 7.4, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality impact. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

Successful exploitation allows a remote attacker to disclose sensitive credentials autofilled by Avira Password Manager in Mozilla Firefox, compromising user confidentiality. There is no impact on integrity or availability. The vulnerability affects users on Windows, macOS, and Linux platforms using Firefox with Avira Password Manager.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when interacting with untrusted web content that may embed cross-origin iframes. Consider disabling autofill features or using alternative browsers or password managers if feasible.