Avast/AVG/Norton 26.7: sandbox escapes and WFP stream-parser crash (CVE-2026-80301–80303) · updates https://pwn.watch/i/avast-sandbox-escape-wfp-cve-2026-80301-80303 On Nov 6 2026 NVD published three Gen Digital (security@nortonlifelock.com) advisories affecting Avast, AVG and Norton Windows products before 26.7. CVE-2026-80301: the Avast sandbox virtualizes filesystem/registry but does not adequately restrict Task Scheduler COM, so a local low-privileged process inside the sandbox can schedule host tasks and escape to elevated host code execution. CVE-2026-80302: insufficient isolation in sandbox file virtualization lets a sandboxed process write arbitrary files to protected host locations and achieve host code execution. CVE-2026-80303: an integer underflow in the WFP stream parser can crash the system (DoS), triggerable remotely via filtered network traffic or locally. Update Avast/AVG/Norton to 26.7 or later. en Fri, 06 Nov 2026 00:00:00 GMT Avast/AVG/Norton 26.7: sandbox escapes and WFP stream-parser crash (CVE-2026-80301–80303): NVD publishes CVE-2026-80301 (Avast/AVG/Norton sandbox escape via Task Scheduler COM), CVE-2026-80302 (sandbox file-virtualization arbitrary write to host), and CVE-2026-80303 (WFP stream-parser integer underflow DoS), fixed in version 26.7+. Gen Digital is the CVE sourceIdentifier. https://pwn.watch/i/avast-sandbox-escape-wfp-cve-2026-80301-80303 https://pwn.watch/i/avast-sandbox-escape-wfp-cve-2026-80301-80303#2026-11-06-fb0bcddd Fri, 06 Nov 2026 00:00:00 GMT high <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-80301">Source</a></p>