Weakness (CWE)
CWE-451: User Interface (UI) Misrepresentation of Critical Information
The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
How to prevent it (2 mitigations)
-
Implementation
Perform data validation (e.g. syntax, length, etc.) before interpreting the data.
-
Architecture and Design
Create a strategy for presenting information, and plan for how to display unusual characters.
Source: MITRE CWE-451
507 results · Feed
-
Medium 4.3
Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform …
-
Medium 4.3
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker…
-
Medium 4.3
Insufficient validation of untrusted input in Wallet in Google Chrome prior to 149.0.7827.53 allowed a remote attacker …
-
Medium 4.3
Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perfor…
-
Medium 4.3
Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform U…
-
Medium 5.4
Inappropriate implementation in TabGroups in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform …
-
Medium 6.5
Incorrect security UI in Tab Hover Cards in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform d…
-
Medium 4.3
Inappropriate implementation in File Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convin…
-
Medium 6.5
Inappropriate implementation in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform doma…
-
Medium 6.5
Incorrect security UI in Tab Strip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain …
-
Medium 4.3
Incorrect security UI in File Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a u…
-
Medium 6.5
Inappropriate implementation in Cronet in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to …
-
High 8.8
Incorrect security UI in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perfo…
-
High 8.8
Incorrect security UI in Contact Picker in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to…
-
Medium 4.3CVE-2026-11107 Public exploit
Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform …
-
Medium 6.5
Inappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker w…
-
Medium 4.2
Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convince…
-
Medium 5.4
Inappropriate implementation in Accessibility in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attac…
-
High 8.4
Dräger Infinity Explorer C700 Privilege Escalation via Kiosk Mode Bypass
Dräger Infinity Explorer C700 contains a privilege escalation vulnerability that allows attackers to break out of kiosk mode and access the underlying operating system through a specific dialog interaction. Attackers can exploit this kiosk escape to take cont…
-
High 7.8
In getAppLabel of ForgetDeviceDialogFragment.java, there is a possible trick the user into forgetting a device due to m…
-
High 7.8
In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into approving access to cer…
-
High 7.8
In multiple locations, there is a possible misleading UI due to obfuscation. This could lead to local escalation of pri…
-
High 7.8
In getCallingAppLabel of CertInstaller.java, there is a possible way to hide a sensitive security dialogue due to misle…
-
Low 3.1
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not …
-
Medium 5.4
Firefox iOS RTL Domain Rendering Issue in Link Preview
Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RTL hostname could visually reorder portions of the displayed domain, causing attacker-controlled site…
-
Medium 4.2
Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker who ha…
-
Medium 5.5
Trilium Notes: macOS TCC Bypass via Prompt Spoofing
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Electron configuration is vulnerable to TCC Bypass via Prompt Spoofing, allowing local attackers to …
-
High 7.5
Spoofing issue in the Popup Blocker component
Spoofing issue in the Popup Blocker component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
-
Medium 4.2
Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had…
-
Medium 4.7
Inappropriate implementation in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convi…
-
Medium 4.2
Incorrect security UI in Downloads in Google Chrome on Android and Mac prior to 148.0.7778.168 allowed a remote attacke…
-
Medium 5.4
Incorrect security UI in Fullscreen in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to perform UI sp…
-
High 7.5
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 an…
-
Medium 4.3
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
-
Medium 4.3
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
-
Medium 6.5
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
-
Medium 4.7
Content Spoofing vulnerability in SAPUI5 (Search UI)
SAPUI5 (Search UI) allows an unauthenticated attacker to manipulate specific URL parameters on the Search UI to include malicious content. Successful exploitation may mislead victim users into clicking and accessing attacker-controlled pages rendered by the a…
-
High 7.5
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 26.5 and …
-
Medium 4.7
Zen Browser Mac - Address Bar Spoofing via Long Subdomain
Zen is a firefox-based browser. Prior to 1.19.12b, the ZEN Browser incorrectly truncates long hostnames in the address bar and shows only the attacker-controlled prefix of the subdomain, hiding the actual registrable domain (eTLD+1). As a result, an attacker …
-
Medium 5.4
Insufficient policy enforcement in WebApp in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform …