CVE Database

CVE-2025-14023 Medium · 4.3 CWE-451 Dec 15, 2025

LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the…

LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the navigation state and the in-app browser's user interface, which could create confusion about the trust context of displayed pages or interactive elements under specific conditions.

CVE-2025-14021 Medium · 4.3 CWE-451 Dec 15, 2025

The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to…

The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to execute malicious JavaScript within iframes while displaying trusted URLs, enabling phishing attacks through overlaid malicious content.

CVE-2025-14020 Medium · 4.3 CWE-451 Dec 15, 2025

LINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in…

LINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in the in-app browser where the full-screen security Toast notification is not properly re-displayed when users return from another application, potentially allowing attackers to conduct phishing attacks by impersonating legitimate interfaces.

CVE-2025-14019 Medium · 4.7 CWE-451 Dec 15, 2025

LINE client for Android versions from 13.8 to 15.5 is vulnerable to UI spoofing in the…

LINE client for Android versions from 13.8 to 15.5 is vulnerable to UI spoofing in the in-app browser where a specific layout could obscure the full-screen warning prompt, potentially allowing attackers to conduct phishing attacks.

CVE-2025-46287 Medium · 6.5 CWE-451 Dec 12, 2025

An inconsistent user interface issue was addressed with improved state management. This…

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. An attacker may be able to spoof their FaceTime caller ID.

CVE-2025-64667 Medium · 5.3 CWE-451 Dec 9, 2025

Microsoft Exchange Server Spoofing Vulnerability

User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2025-62223 Medium · 4.3 CWE-451 Dec 4, 2025

Microsoft Edge (Chromium-based) for Mac Spoofing Vulnerability

User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.

CVE-2025-31266 Medium · 4.3 CWE-451 Nov 21, 2025

A spoofing issue was addressed with improved truncation when displaying the fully qualified...

A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name. This issue is fixed in Safari 18.5, macOS Sequoia 15.5. A website may be able to spoof the domain name in the title of a pop-up window.

CVE-2025-13082 Medium · 4.3 CWE-451 Nov 18, 2025

Drupal core - Moderately critical - Defacement - SA-CORE-2025-007

User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.

CVE-2025-13107 Medium · 4.3 CWE-451 Nov 14, 2025

Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80…

Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2025-13102 Medium · 4.3 CWE-451 Nov 14, 2025

Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to…

Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2024-7021 Medium · 4.3 CWE-451 Nov 14, 2025

Inappropriate implementation in Autofill in Google Chrome on Windows prior to…

Inappropriate implementation in Autofill in Google Chrome on Windows prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2024-13178 Medium · 4.3 CWE-451 Nov 14, 2025

Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84…

Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2024-11919 Medium · 4.3 CWE-451 Nov 14, 2025

Inappropriate implementation in Intents in Google Chrome on Android prior to…

Inappropriate implementation in Intents in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2025-12729 Medium · 4.2 CWE-451 Nov 10, 2025

Inappropriate implementation in Omnibox in Google Chrome on Android prior to…

Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-12728 Medium · 4.2 CWE-451 Nov 10, 2025

Inappropriate implementation in Omnibox in Google Chrome on Android prior to…

Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-12446 Medium · 4.2 CWE-451 Nov 10, 2025

Incorrect security UI in SplitView in Google Chrome prior to 142.0.7444.59 allowed a…

Incorrect security UI in SplitView in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain name. (Chromium security severity: Low)

CVE-2025-12911 Medium · 4.3 CWE-451 Nov 7, 2025

Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80…

Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2025-11213 Medium · 6.3 CWE-451 Nov 6, 2025

Inappropriate implementation in Omnibox in Google Chrome on Android prior to…

Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-11212 Medium · 6.3 CWE-451 Nov 6, 2025

Inappropriate implementation in Media in Google Chrome on Windows prior to 141.0.7390.54…

Inappropriate implementation in Media in Google Chrome on Windows prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-11208 Medium · 6.3 CWE-451 Nov 6, 2025

Inappropriate implementation in Media in Google Chrome prior to 141.0.7390.54 allowed a…

Inappropriate implementation in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-11720 High · 8.1 CWE-451 Oct 14, 2025

Spoofing risk in Android custom tabs

The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site. This vulnerability was fixed in Firefox 144.

CVE-2025-11718 Medium · 6.5 CWE-451 Oct 14, 2025

Address bar could be spoofed on Android using visibilitychange

When the address bar was hidden due to scrolling on Android, a malicious page could create a fake address bar to fool the user in response to a visibilitychange event. This vulnerability was fixed in Firefox 144.

CVE-2025-10290 Medium · 6.5 CWE-451 Sep 16, 2025

Opening links via the contextual menu in Focus for iOS would not update the toolbar UI correctly, allowing attackers to spoof websites

Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers to spoof websites if users were coerced into opening a link explicitly through a long-press. This vulnerability was fixed in Focus for iOS 143.0.

CVE-2025-43327 Medium · 6.5 CWE-451 Sep 15, 2025

The issue was addressed by adding additional logic. This issue is fixed in Safari 26, macOS Tahoe...

The issue was addressed by adding additional logic. This issue is fixed in Safari 26, macOS Tahoe 26. Visiting a malicious website may lead to address bar spoofing.