Improper Isolation in Avast Sandbox Allows Local Code Execution
CVE-2026-80301
Key Information:
What is CVE-2026-80301?
A vulnerability in the Avast sandbox environment allows a local, low-privileged attacker to bypass containment measures. This occurs due to improper isolation that does not adequately restrict access to the COM interfaces associated with the Task Scheduler service. Attackers can instantiate COM objects that enable them to invoke methods used for scheduling and executing tasks on the host system. This lack of isolation can lead to arbitrary code execution outside the sandbox, effectively allowing attackers to escalate privileges and compromise the host system.
Affected Version(s)
Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate Windows 0
AVG Antivirus Free, AVG Internet Security, AVG Ultimate Windows 0
Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced Windows 0