Weakness (CWE)
CWE-1021: Improper Restriction of Rendered UI Layers or Frames
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
How to prevent it (4 mitigations)
-
Implementation
Use the "frame-ancestors" directive in the Content Security Policy, which is intended to define restrictions when it comes to allowing embedded content [REF-1544].
-
Implementation
The use of X-Frame-Options (now partially obsolete as of September 2026 [REF-1545]) allows developers of web content to restrict the usage of their application within the form of overlays, frames, or iFrames. The developer can indicate from which domains can frame the content.
The concept of X-Frame-Options is well documented, but implementation of this protection mechanism is in development to cover gaps; often, there is a need for allowing frames from multiple domains.
-
Implementation
Use a "frame-breaker" script in each page that should not be framed. This is very helpful for legacy browsers that do not support the X-Frame-Options security feature previously mentioned (which is now partially obsolete).
-
Implementation
In addition to frames or iframes as previously mentioned, the web application is expected to place restrictions on whether it is allowed to be rendered within objects, embed, or applet elements.
Source: MITRE CWE-1021
247 results · Feed
-
Medium 6.4
Improper Restriction of Rendered UI Layers or Frames in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 7.7 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions, an attacker could potentially trick users into unintentionally authorizing sensitive actions on…
-
Medium 6.5
Improper restriction of rendered UI layers or frames issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user view…
-
Medium 5.5
tarteaucitron.js allows UI manipulation via unrestricted CSS injection
tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user-controlled inputs for element dimensions (width and height) were not properly validated. This allowed an attacker with…
-
Medium 4.3
Improper restriction of rendered UI layers or frames issue exists in HMI ViewJet C-more series, which may allow a remot…
-
Medium 4.3
Inappropriate implementation in Permission Prompts in Google Chrome prior to 134.0.6998.35 allowed an attacker who conv…
-
Medium 4.3
Inappropriate implementation in Browser UI in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker…
-
High 7.1
Android Intent confirmation prompt tapjacking using Select options
A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. *This issue only affects Android versions of Firefox.*. This vulnerability w…
-
Medium 6.8
Missing Defense in Depth Against Clickjacking in SAP Commerce Backoffice
SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not be the case in the future as browsers might discontinue support for this header in favor of the frame…
-
Medium 5.4
IBM ApplinX Clickjacking
IBM ApplinX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch furth…
-
Medium 4.3
Fullscreen notification not properly displayed
The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack. This vulnerability was fixed in Firefox 135 and Thunderbird 135.
-
High 7.3
Fullscreen notification is not displayed when fullscreen is re-requested
The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential spoofing attack. This vulnerability was fixed in Firefox 135 and Thunderbird 135.
-
Medium 5.3
NEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products…
-
Medium 6.9
`frame-ancestors: self` grants all users access to formgrader in nbgrader
nbgrader is a system for assigning and grading notebooks. Enabling frame-ancestors: 'self' grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default Jupy…
-
Medium 6.4
Clickjacking vulnerability in typecho v1.2.1.
-
Medium 5.5
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerabilit…
-
Medium 6.2
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerabilit…
-
Medium 5.2
IBM InfoSphere Information Server clickjacking
IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and…
-
High 7.1
Content Security Policy appears to be missing in software and production setup
Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the productions server appeared to have been misconfigured and missed providing any content security policy or security headers. This could resu…
-
Medium 5.5
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerabilit…
-
Medium 6.2
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerabilit…
-
Medium 5.4
Under certain circumstances, navigating to a webpage would result in the address missing from the location URL bar, mak…
-
Medium 5.4
A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulti…
-
High 8.1
Malicious websites may have been able to perform user intent confirmation through tapjacking. This could have led to us…
-
Medium 6.8
Improper Restriction of Rendered UI Layers or Frames in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 prior to 17.5.2, which could have allowed an attacker gaining full API access as the victim via the De…
-
Medium 6.2
In visitUris of multiple files, there is a possible information disclosure due to a confused deputy. This could lead to…
-
Medium 6.1
Clickjacking vulnerability in Clibo Manager
Clickjacking vulnerability in Clibo Manager v1.1.9.12 in the '/public/login' directory, a login panel. This vulnerability occurs due to the absence of an X-Frame-Options server-side header. An attacker could overlay a transparent iframe to perform click hijac…
-
Critical 9.1
Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in s…
-
Medium 6.1
A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permis…
-
Medium 4.3
Multiple prompts and panels from both Firefox and the Android OS could be used to obscure the notification announcing t…
-
Medium 6.3
A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into g…
-
Medium 6.5
Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a sp…
-
Medium 6.1
Discourse allows iframe injection though default site setting
Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, the vulnerability allows an attacker to inject iframes from any domain, bypassing the intended restrictions enforced by the allowed_iframes setting. This vulnerability is fixed i…
-
Medium 6.1
The issue was addressed with improved UI handling. This issue is fixed in Safari 17.6, macOS Monterey 12.7.6, macOS Son…
-
Medium 5.4
Inappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to poten…
-
High 7.8
In hide of WindowState.java, there is a possible way to bypass tapjacking/overlay protection by launching the activity …
-
Medium 6.8
Improper Restriction of Rendered UI Layers or Frames in GitLab
A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow via a crafted paylo…
-
Low 3.7
Lack of Clickjacking Protection vulnerability affects DRYiCE AEX v10
HCL DRYiCE AEX is impacted by a lack of clickjacking protection in the AEX web application. An attacker can use multiple transparent or opaque layers to trick a user into clicking on a button or link on another page than the one intended.
-
Medium 4.3
IBM Sterling B2B Integrator Standard Edition tapjacking
IBM Sterling B2B Integrator Standard Edition 6.1 and 6.2 does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. I…
-
High 8.1
LB-LINK BL-W1210M v2.0 was discovered to contain a clickjacking vulnerability via the Administrator login page. Attacke…
-
Medium 4.3
Clickjacking Vulnerability in zenml-io/zenml
A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options or Content-Security-Policy HTTP headers. This vulnerability allows an attacker to embed the applicati…