A vulnerability within the Avira Password Manager Browser Extensions provided a potential…
Priority LOW 31Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted by an attacker, the discovered vulnerability could trigger the Password Manager Extension to fill in the password field automatically. An attacker could then access this information via JavaScript. The issue was fixed with the browser extensions version 2.18.5 for Chrome, MS Edge, Opera, Firefox, and Safari.
Why it matters now
EPSS 0.01022 63rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Avira Password Manager – Browser Extensions | Avira Password Manager - extension for Chrome; version 2.18.4.3868 Avira Password Manager - extension for MS Edge; version 2.18.4.3847 Avira Password Manager - extension for Opera; version 2.18.4.3847 Avira Password Manager - extension for Firefox; version 2.18.4.38471 Avira Password Manager - extension for Safari; version 2.18.4 | — | No fix listed | CNA |
- Avira Password Manager – Browser Extensions Vendor— Affected Avira Password Manager - extension for Chrome; version 2.18.4.3868 Avira Password Manager - extension for MS Edge; version 2.18.4.3847 Avira Password Manager - extension for Opera; version 2.18.4.3847 Avira Password Manager - extension for Firefox; version 2.18.4.38471 Avira Password Manager - extension for Safari; version 2.18.4 Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:avira:password_manager:2.18.4:*:*:*:*:safari:*:* | 2.18.4 | Vulnerable | Gen Digital |
| cpe:2.3:a:avira:password_manager:2.18.4.3847:*:*:*:*:edge:*:* | 2.18.4.3847 | Vulnerable | Gen Digital |
| cpe:2.3:a:avira:password_manager:2.18.4.3847:*:*:*:*:opera:*:* | 2.18.4.3847 | Vulnerable | Gen Digital |
| cpe:2.3:a:avira:password_manager:2.18.4.3868:*:*:*:*:chrome:*:* | 2.18.4.3868 | Vulnerable | Gen Digital |
| cpe:2.3:a:avira:password_manager:2.18.4.38471:*:*:*:*:firefox:*:* | 2.18.4.38471 | Vulnerable | Gen Digital |
- cpe:2.3:a:avira:password_manager:2.18.4:*:*:*:*:safari:*:* Versions 2.18.4 Vulnerable ·Gen Digital
- cpe:2.3:a:avira:password_manager:2.18.4.3847:*:*:*:*:edge:*:* Versions 2.18.4.3847 Vulnerable ·Gen Digital
- cpe:2.3:a:avira:password_manager:2.18.4.3847:*:*:*:*:opera:*:* Versions 2.18.4.3847 Vulnerable ·Gen Digital
- cpe:2.3:a:avira:password_manager:2.18.4.3868:*:*:*:*:chrome:*:* Versions 2.18.4.3868 Vulnerable ·Gen Digital
- cpe:2.3:a:avira:password_manager:2.18.4.38471:*:*:*:*:firefox:*:* Versions 2.18.4.38471 Vulnerable ·Gen Digital
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-28795
- 2026-10-03 Alias added: GHSA-rqq4-vj49-wj54
References
Sources
- CVE-2022-28795 · CVE Program
- CVE-2022-28795 · NVD
- FIRST EPSS
- GHSA-rqq4-vj49-wj54 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences