Total
434 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-18007 | 1 Google | 2 Android, Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Inappropriate implementation in Input in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-18010 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low) | |||||
| CVE-2026-17980 | 1 Google | 2 Android, Chrome | 2026-10-23 | N/A | 3.1 LOW |
| Inappropriate implementation in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-17938 | 1 Google | 2 Android, Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Inappropriate implementation in FullScreen in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-18003 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2025-10290 | 1 Mozilla | 1 Firefox Focus | 2026-10-23 | N/A | 6.5 MEDIUM |
| Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers to spoof websites if users were coerced into opening a link explicitly through a long-press. This vulnerability was fixed in Focus for iOS 143.0. | |||||
| CVE-2026-18009 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low) | |||||
| CVE-2026-17915 | 1 Google | 2 Android, Chrome | 2026-10-23 | N/A | 5.4 MEDIUM |
| Inappropriate implementation in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-18018 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-10-23 | N/A | 4.0 MEDIUM |
| Inappropriate implementation in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform UI spoofing via a malicious file. (Chromium security severity: Low) | |||||
| CVE-2026-17941 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-17998 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low) | |||||
| CVE-2026-17913 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-10-23 | N/A | 5.4 MEDIUM |
| Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-17945 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Insufficient validation of untrusted input in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-17983 | 1 Google | 1 Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Inappropriate implementation in Global Media Controls in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-17965 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-10-23 | N/A | 4.3 MEDIUM |
| Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-18487 | 2026-10-23 | N/A | 5.4 MEDIUM | ||
| A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, [https://trusted.com:80@attacker.com/](https://trusted.com:80@attacker.com/)), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site. | |||||
| CVE-2026-74975 | 1 Mozilla | 1 Firefox Mobile | 2026-10-22 | N/A | 5.4 MEDIUM |
| Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154. | |||||
| CVE-2025-52652 | 2026-10-19 | N/A | 3.5 LOW | ||
| HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as though it originates from a trusted source, potentially leading to phishing or data theft. | |||||
| CVE-2026-109434 | 2026-10-19 | N/A | 4.3 MEDIUM | ||
| Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attackers can render a counterfeit address bar showing a trusted origin over attacker-controlled content after a single user tap, enabling credential harvesting, malware delivery, or social engineering through fake login, update, or payment pages. | |||||
| CVE-2026-109747 | 2026-10-19 | N/A | 7.3 HIGH | ||
| Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | |||||