Weakness (CWE)
CWE-451: User Interface (UI) Misrepresentation of Critical Information
Class Draft
The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
How to prevent it (2 mitigations)
-
Implementation
Perform data validation (e.g. syntax, length, etc.) before interpreting the data.
-
Architecture and Design
Create a strategy for presenting information, and plan for how to display unusual characters.
Source: MITRE CWE-451
507 results · Feed
-
High 8.8
UI misrepresentation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social …
-
High 8.8
UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social eng…
-
Critical 9.6
UI misrepresentation in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker l…
-
High 8.8
UI misrepresentation in UI in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging s…
-
High 8.8
UI misrepresentation in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spo…
-
High 8.8
UI misrepresentation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoo…
-
High 8.8
UI misrepresentation in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spo…
-
High 8.8
UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof addre…
-
High 8.8
UI misrepresentation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the…
-
High 8.8
UI misrepresentation in Model in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engin…
-
High 8.8
UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elemen…
-
High 8.8
UI misrepresentation in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoo…
-
High 8.8
UI misrepresentation in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to s…
-
High 8.8
UI misrepresentation in Autofill in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to spoof U…
-
High 8.8
UI misrepresentation in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had co…
-
High 8.8
UI misrepresentation in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spo…
-
Medium 6.5
UI misrepresentation in Ozone in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements vi…
-
Medium 6.5
UI misrepresentation in Payments in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar…
-
Critical 9.6
UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging soc…
-
High 8.8
UI misrepresentation in Interstitials in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging soci…
-
High 8.8
UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social eng…
-
High 8.8
UI misrepresentation in TrustedWebActivities in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote att…
-
Medium 6.5
UI misrepresentation in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker …
-
High 8.8
UI misrepresentation in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements …
-
Critical 9.6
UI misrepresentation in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveragi…
-
High 8.8
UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address b…
-
High 8.8
UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social …
-
High 8.8
UI misrepresentation in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leverag…
-
High 8.8
UI misrepresentation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker leveraging socia…
-
High 8.8
UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elemen…
-
High 8.8
UI misrepresentation in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had comprom…
-
High 8.8
UI misrepresentation in Internals in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to spoof …
-
High 8.8
UI misrepresentation in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to s…
-
High 8.8
UI misrepresentation in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker leveragi…
-
High 8.8
UI misrepresentation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar vi…
-
High 8.8
UI misrepresentation in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had…
-
Medium 4.3
Sleipnir Browser < 3.9.0 Fullscreen Address Bar Spoofing
Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification…
-
High 7.3
Other issue in the Address Bar component
Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
-
High 8.1
Frame poisoning in the Layout component
Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.45.
-
High 8.1
better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device
better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-i…