Answer in brief
CVE-2026-80301 records a Unknown severity vulnerability in Avast sandbox escape via unpreserved COM pathway through Task Scheduler. The current sources do not mark it as known exploited. The current feed maps Gen Digital/Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate (generic), Gen Digital/AVG Antivirus Free, AVG Internet Security, AVG Ultimate (generic), Gen Digital/Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Gen Digital/Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate (generic), Gen Digital/AVG Antivirus Free, AVG Internet Security, AVG Ultimate (generic), Gen Digital/Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Gen Digital/Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimategeneric | * | Not reported |
| Gen Digital/AVG Antivirus Free, AVG Internet Security, AVG Ultimategeneric | * | Not reported |
| Gen Digital/Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advancedgeneric | * | Not reported |
Published upstream
Nov 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 6, 2026
Improper isolation in the Avast sandbox on Windows allows a local, low-privileged attacker executing inside the sandbox to access COM interfaces to the Task Scheduler service, escape containment, and execute code with elevated privileges outside the sandbox. The sandbox virtualizes file system and registry access but does not adequately restrict COM interface access to Task Scheduler. A process inside the sandbox can instantiate COM objects bound to Task Scheduler functionality and invoke methods to schedule and execute tasks on the host system. The Task Scheduler COM pathway is not blocked by the sandbox policy, allowing arbitrary code execution in the host security context. This escape vector bypasses the sandbox's intended process and file isolation boundaries and can be chained with other host-level privilege escalation techniques.
Quoted source text, attributed separately from HOL analysis.