CVE-2020-8987: Avast Antitrack

High severity, CVSS 7.4. EPSS: 0.5% chance of exploitation in the next 30 days.

Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.0.0.178 proxies traffic to HTTPS sites but does not validate certificates, and thus a man-in-the-middle can host a malicious website using a self-signed certificate. No special action necessary by the victim using AntiTrack with "Allow filtering of HTTPS traffic for tracking detection" enabled. (This is the default configuration.)

Affected products

• Avast Antitrack: before 1.5.1.172 (fixed in 1.5.1.172)
• Avast Avg Antitrack: before 2.0.0.178 (fixed in 2.0.0.178)

Published 2020-03-09. Last modified 2026-06-17.