This vulnerability (CVE-2026-12068) involves incorrect resource transfer between contexts (CWE-669) in Avira Password Manager when integrated with Mozilla Firefox. Specifically, a remote attacker operating a cross-origin iframe can leverage improper autofill field selection to access credentials autofilled for the parent page, resulting in information disclosure. The issue affects the product on Windows, macOS, and Linux platforms. The CVSS v3.1 base score is 7.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality impact with no integrity or availability impact. There is no vendor advisory or patch information available at this time.

The vulnerability allows a remote attacker to disclose sensitive credential information autofilled by Avira Password Manager in Mozilla Firefox via a cross-origin iframe. This compromises confidentiality of user credentials but does not affect integrity or availability of the system or data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when interacting with untrusted web content that may embed cross-origin iframes. Avoid enabling autofill on untrusted sites or consider disabling the password manager autofill feature in Firefox as a temporary mitigation.