ByteOS

Product

Safari

Versions

Affected

From 0 before 26.1 (custom)

Vendor

Product

iOS and iPadOS

Versions

Affected

From 0 before 18.7.2 (custom)
From 0 before 26.1 (custom)

Vendor

Product

macOS

Versions

Affected

From 0 before 26.1 (custom)

Vendor

Product

visionOS

Versions

Affected

From 0 before 26.1 (custom)

Problem Types

Type	CWE ID	Description
N/A	N/A	Visiting a malicious website may lead to address bar spoofing

Type: N/A

CWE ID: N/A

Description: Visiting a malicious website may lead to address bar spoofing

References

Hyperlink	Resource
https://support.apple.com/en-us/125632	N/A
https://support.apple.com/en-us/125633	N/A
https://support.apple.com/en-us/125634	N/A
https://support.apple.com/en-us/125638	N/A
https://support.apple.com/en-us/125640	N/A

Hyperlink: https://support.apple.com/en-us/125632

Resource: N/A

Hyperlink: https://support.apple.com/en-us/125633

Resource: N/A

Hyperlink: https://support.apple.com/en-us/125634

Resource: N/A

Hyperlink: https://support.apple.com/en-us/125638

Resource: N/A

Hyperlink: https://support.apple.com/en-us/125640

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-290	CWE-290 Authentication Bypass by Spoofing

Type: CWE

CWE ID: CWE-290

Description: CWE-290 Authentication Bypass by Spoofing

Metrics

Version	Base score	Base severity	Vector
3.1	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:product-security@apple.com

Published At:04 Nov, 2025 | 02:15

Updated At:02 Apr, 2026 | 19:20

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CPE Matches

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*

>>safari>>Versions before 26.1(exclusive)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

>>ipados>>Versions before 26.1(exclusive)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

>>iphone_os>>Versions before 26.1(exclusive)

cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*

>>visionos>>Versions before 26.1(exclusive)

Weaknesses

CWE ID	Type	Source
CWE-290	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-290

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://support.apple.com/en-us/125632	product-security@apple.com	N/A
https://support.apple.com/en-us/125633	product-security@apple.com	N/A
https://support.apple.com/en-us/125634	product-security@apple.com	N/A
https://support.apple.com/en-us/125638	product-security@apple.com	N/A
https://support.apple.com/en-us/125640	product-security@apple.com	N/A

Hyperlink: https://support.apple.com/en-us/125632

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://support.apple.com/en-us/125633

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://support.apple.com/en-us/125634

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://support.apple.com/en-us/125638

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://support.apple.com/en-us/125640

Source: product-security@apple.com

Resource: N/A

Similar CVEs

115Records found

CVE-2023-42843

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.5||HIGH

EPSS-0.10% / 26.62%

7 Day CHG~0.00%

Published-21 Feb, 2024 | 06:41

Updated-13 Feb, 2025 | 17:09

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1, Safari 17.1, macOS Sonoma 14.1. Visiting a malicious website may lead to address bar spoofing.

Vendor-wpewebkit webkitgtk Fedora Project Apple Inc.

Product-iphone_os ipad_os safari fedora webkitgtk macos wpe_webkit iOS and iPadOS macOS Safari safari ios_and_ipados macos

CWE ID-CWE-290

Authentication Bypass by Spoofing

CVE-2025-43503

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.04% / 11.76%

7 Day CHG~0.00%

Published-04 Nov, 2025 | 01:17

Updated-02 Apr, 2026 | 19:20

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Visiting a malicious website may lead to user interface spoofing.

Vendor-Apple Inc.

Product-visionos watchos safari iphone_os ipados Safari visionOS macOS iOS and iPadOS watchOS

CWE ID-CWE-290

Authentication Bypass by Spoofing

CVE-2025-30467

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.27% / 50.57%

7 Day CHG~0.00%

Published-31 Mar, 2025 | 22:23

Updated-02 Apr, 2026 | 19:19

The issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, watchOS 11.4. Visiting a malicious website may lead to address bar spoofing.

Vendor-Apple Inc.

Product-iphone_os safari ipados macos Safari iOS and iPadOS watchOS macOS

CWE ID-CWE-451

User Interface (UI) Misrepresentation of Critical Information

CVE-2022-29048

Matching Score-8

Assigner-Jenkins Project

Matching Score-8

Assigner-Jenkins Project

CVSS Score-4.3||MEDIUM

EPSS-0.20% / 41.75%

7 Day CHG~0.00%

Published-12 Apr, 2022 | 19:50

Updated-20 Nov, 2024 | 15:28

A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL.

Vendor-Apple Inc.Jenkins

Product-subversion macos Jenkins Subversion Plugin

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2023-41975

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.18% / 38.77%

7 Day CHG~0.00%

Published-25 Oct, 2023 | 18:31

Updated-13 Feb, 2025 | 17:09

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. A website may be able to access the microphone without the microphone use indicator being shown.

Vendor-Apple Inc.

Product-macos macOS

CVE-2026-2323

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.01% / 1.45%

7 Day CHG~0.00%

Published-11 Feb, 2026 | 18:08

Updated-13 Feb, 2026 | 14:51

Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

Vendor-Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation Google LLC

CWE ID-CWE-451

User Interface (UI) Misrepresentation of Critical Information

CVE-2025-27425

Matching Score-8

Assigner-Mozilla Corporation

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.31% / 54.11%

7 Day CHG~0.00%

Published-04 Mar, 2025 | 13:31

Updated-13 Apr, 2026 | 15:16

QR code user confirmation bypass with invalid protocol

Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first. This vulnerability was fixed in Firefox for iOS 136.

Vendor-Apple Inc.Mozilla Corporation

Product-firefox iphone_os Firefox for iOS

CWE ID-CWE-287

Improper Authentication

CVE-2025-27424

Matching Score-8

Assigner-Mozilla Corporation

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.34% / 56.72%

7 Day CHG~0.00%

Published-04 Mar, 2025 | 13:31

Updated-13 Apr, 2026 | 15:16

Firefox Mobile iOS Address Bar Spoof Using Server-Side Redirect to non-http Scheme

Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page. This vulnerability was fixed in Firefox for iOS 136.

Vendor-Apple Inc.Mozilla Corporation

Product-firefox iphone_os Firefox for iOS

CWE ID-CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

CVE-2022-22654

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 44.70%

7 Day CHG~0.00%

Published-18 Mar, 2022 | 18:00

Updated-03 Aug, 2024 | 03:21

A user interface issue was addressed. This issue is fixed in watchOS 8.5, Safari 15.4. Visiting a malicious website may lead to address bar spoofing.

Vendor-Apple Inc.

Product-safari watchos watchOS Safari

CVE-2025-24128

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.14% / 33.63%

7 Day CHG~0.00%

Published-27 Jan, 2025 | 21:45

Updated-02 Apr, 2026 | 19:19

The issue was addressed by adding additional logic. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3. Visiting a malicious website may lead to address bar spoofing.

Vendor-Apple Inc.

Product-iphone_os safari ipados macos Safari iOS and iPadOS macOS

CVE-2025-13637

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-4.3||MEDIUM

EPSS-0.02% / 5.48%

7 Day CHG~0.00%

Published-02 Dec, 2025 | 19:00

Updated-04 Dec, 2025 | 19:39

Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass download protections via a crafted HTML page. (Chromium security severity: Low)

Vendor-Apple Inc.Microsoft Corporation Linux Kernel Organization, Inc Google LLC

Product-macos linux_kernel windows chrome Chrome

CWE ID-CWE-449

The UI Performs the Wrong Action

CVE-2019-8670

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 44.70%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.6, Safari 12.1.2. Visiting a malicious website may lead to address bar spoofing.

Vendor-Apple Inc.

Product-safari mac_os_x Safari macOS

CWE ID-CWE-20

Improper Input Validation

CVE-2019-5873

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.24% / 46.47%

7 Day CHG~0.00%

Published-25 Nov, 2019 | 14:22

Updated-04 Aug, 2024 | 20:09

Insufficient policy validation in navigation in Google Chrome on iOS prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

Vendor-Apple Inc.Google LLC

Product-chrome iphone_os Chrome

CVE-2022-22677

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.20% / 42.43%

7 Day CHG~0.00%

Published-01 Nov, 2022 | 00:00

Updated-06 May, 2025 | 20:15

A logic issue in the handling of concurrent media was addressed with improved state handling. This issue is fixed in macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5. Video self-preview in a webRTC call may be interrupted if the user answers a phone call.

Vendor-Apple Inc.

Product-macos ipados iphone_os macOS

CVE-2022-22380

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5||MEDIUM

EPSS-0.03% / 7.51%

7 Day CHG~0.00%

Published-17 Oct, 2023 | 01:25

Updated-13 Sep, 2024 | 18:07

IBM Security Verify Privilege improper authentication

IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to spoof a trusted entity due to improperly validating certificates. IBM X-Force ID: 221957.

Vendor-Apple Inc.Microsoft Corporation IBM Corporation

Product-security_verify_privilege_on-premises macos windows Security Verify Privilege

CWE ID-CWE-295

Improper Certificate Validation

CVE-2022-32795

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.32% / 54.98%

7 Day CHG~0.00%

Published-20 Sep, 2022 | 00:00

Updated-03 Aug, 2024 | 07:54

This issue was addressed with improved checks. This issue is fixed in iOS 16, iOS 15.7 and iPadOS 15.7. Visiting a malicious website may lead to address bar spoofing.

Vendor-Apple Inc.

Product-iphone_os ipados iOS iOS and iPadOS

CVE-2019-5840

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.60% / 69.82%

7 Day CHG~0.00%

Published-27 Jun, 2019 | 16:13

Updated-04 Aug, 2024 | 20:09

Incorrect security UI in popup blocker in Google Chrome on iOS prior to 75.0.3770.80 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

Vendor-Google LLC openSUSE Apple Inc.Fedora Project Debian GNU/Linux

Product-iphone_os debian_linux chrome fedora backports leap Chrome

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVE-2025-8577

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.08% / 22.86%

7 Day CHG~0.00%

Published-07 Aug, 2025 | 01:30

Updated-08 Aug, 2025 | 18:24

Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Vendor-Microsoft Corporation Apple Inc.Linux Kernel Organization, Inc Google LLC

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-8583

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.07% / 20.43%

7 Day CHG~0.00%

Published-07 Aug, 2025 | 01:30

Updated-08 Aug, 2025 | 18:23

Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

Vendor-Microsoft Corporation Apple Inc.Linux Kernel Organization, Inc Google LLC

CWE ID-CWE-451

User Interface (UI) Misrepresentation of Critical Information

CVE-2025-8580

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.08% / 22.86%

7 Day CHG~0.00%

Published-07 Aug, 2025 | 01:30

Updated-08 Aug, 2025 | 18:24

Inappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

Vendor-Microsoft Corporation Apple Inc.Linux Kernel Organization, Inc Google LLC

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-8582

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.09% / 25.28%

7 Day CHG~0.00%

Published-07 Aug, 2025 | 01:30

Updated-13 Nov, 2025 | 18:46

Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)

Vendor-Linux Kernel Organization, Inc Apple Inc.Google LLC Microsoft Corporation

Product-chrome windows macos linux_kernel Chrome

CWE ID-CWE-20

Improper Input Validation

CVE-2024-8909

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.13% / 31.39%

7 Day CHG~0.00%

Published-17 Sep, 2024 | 21:07

Updated-17 Mar, 2025 | 16:15

Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

Vendor-Google LLC Apple Inc.

Product-chrome iphone_os Chrome

CWE ID-CWE-451

User Interface (UI) Misrepresentation of Critical Information

CVE-2020-3888

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.26% / 48.89%

7 Day CHG~0.00%

Published-01 Apr, 2020 | 17:46

Updated-04 Aug, 2024 | 07:52

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4. A maliciously crafted page may interfere with other web contexts.

Vendor-Apple Inc.

Product-iphone_os ipad_os iOS

CVE-2025-8579

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.08% / 22.86%

7 Day CHG~0.00%

Published-07 Aug, 2025 | 01:30

Updated-08 Aug, 2025 | 18:24

Vendor-Microsoft Corporation Apple Inc.Linux Kernel Organization, Inc Google LLC

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-13667

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.24% / 46.47%

7 Day CHG~0.00%

Published-25 Nov, 2019 | 14:22

Updated-04 Aug, 2024 | 23:57

Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

Vendor-Apple Inc.Google LLC

Product-chrome iphone_os Chrome

CVE-2017-5118

Matching Score-8

Assigner-Chrome

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Red Hat, Inc.Microsoft Corporation Debian GNU/Linux

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.33% / 55.97%

7 Day CHG~0.00%

Published-27 Oct, 2017 | 05:00

Updated-13 May, 2026 | 00:24

Blink in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, failed to correctly propagate CSP restrictions to javascript scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page.

Product-debian_linux enterprise_linux_server enterprise_linux_workstation enterprise_linux_desktop windows macos chrome android linux_kernel Google Chrome prior to 61.0.3163.79 for Mac, Windows and Linux, and 61.0.3163.81 for Android

CWE ID-CWE-732

Incorrect Permission Assignment for Critical Resource

CVE-2017-5109

Matching Score-8

Assigner-Chrome

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Red Hat, Inc.Microsoft Corporation Debian GNU/Linux

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.68% / 71.84%

7 Day CHG~0.00%

Published-27 Oct, 2017 | 05:00

Updated-13 May, 2026 | 00:24

Inappropriate implementation of unload handler handling in permission prompts in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to display UI on a non attacker controlled tab via a crafted HTML page.

Product-debian_linux enterprise_linux_server enterprise_linux_workstation enterprise_linux_desktop windows macos chrome linux_kernel Google Chrome prior to 60.0.3112.78 for Linux, Windows and Mac

CWE ID-CWE-20

Improper Input Validation

CVE-2017-5033

Matching Score-8

Assigner-Chrome

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Red Hat, Inc.Microsoft Corporation Debian GNU/Linux

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.61% / 69.86%

7 Day CHG~0.00%

Published-24 Apr, 2017 | 23:00

Updated-13 May, 2026 | 00:24

Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page, related to the unsafe-inline keyword.

Product-debian_linux enterprise_linux_server enterprise_linux_workstation enterprise_linux_desktop windows macos chrome android linux_kernel Google Chrome prior to 57.0.2987.98 for Mac, Windows and Linux, and 57.0.2987.108 for Android

CWE ID-CWE-281

Improper Preservation of Permissions

CVE-2017-5079

Matching Score-8

Assigner-Chrome

Product-enterprise_linux_server enterprise_linux_workstation enterprise_linux_desktop windows macos chrome android linux_kernel Google Chrome prior to 59.0.3071.86 for Mac, Windows and Linux, and 59.0.3071.92 for Android

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.67% / 71.48%

7 Day CHG~0.00%

Published-27 Oct, 2017 | 05:00

Updated-13 May, 2026 | 00:24

Inappropriate implementation in Blink in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote attacker to display UI on a non attacker controlled tab via a crafted HTML page.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Red Hat, Inc.Microsoft Corporation

CWE ID-CWE-20

Improper Input Validation

CVE-2021-21186

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.43% / 62.90%

7 Day CHG~0.00%

Published-09 Mar, 2021 | 17:46

Updated-03 Aug, 2024 | 18:01

Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an attacker who convinced the user to scan a QR code to bypass navigation restrictions via a crafted QR code.

Vendor-Google LLC Apple Inc.Fedora Project Debian GNU/Linux

Product-chrome iphone_os debian_linux fedora Chrome

CWE ID-CWE-863

Incorrect Authorization

CVE-2021-1854

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.21% / 42.84%

7 Day CHG~0.00%

Published-08 Sep, 2021 | 14:45

Updated-03 Aug, 2024 | 16:25

A call termination issue with was addressed with improved logic. This issue is fixed in iOS 14.5 and iPadOS 14.5. A legacy cellular network can automatically answer an incoming call when an ongoing call ends or drops. .

Vendor-Apple Inc.

Product-iphone_os ipados iOS and iPadOS

CWE ID-CWE-863

Incorrect Authorization

CVE-2020-9942

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.25% / 48.01%

7 Day CHG~0.00%

Published-08 Dec, 2020 | 19:17

Updated-04 Aug, 2024 | 10:50

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, Safari 13.1.2. Visiting a malicious website may lead to address bar spoofing.

Vendor-Apple Inc.

Product-safari mac_os_x Safari macOS

CWE ID-CWE-1021

Improper Restriction of Rendered UI Layers or Frames

CVE-2020-6797

Matching Score-8

Assigner-Mozilla Corporation

Matching Score-8

Assigner-Mozilla Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.02% / 77.45%

7 Day CHG~0.00%

Published-02 Mar, 2020 | 04:05

Updated-04 Aug, 2024 | 09:11

By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer. The attacker is restricted as they are unable to download non-quarantined files or supply command line arguments to the application, limiting the impact. Note: this issue only occurs on Mac OSX. Other operating systems are unaffected. This vulnerability affects Thunderbird < 68.5, Firefox < 73, and Firefox < ESR68.5.

Vendor-Mozilla Corporation Apple Inc.

Product-firefox thunderbird macos firefox_esr Thunderbird Firefox

CWE ID-CWE-20

Improper Input Validation

CVE-2020-6403

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-1.38% / 80.47%

7 Day CHG~0.00%

Published-11 Feb, 2020 | 14:42

Updated-04 Aug, 2024 | 09:02

Incorrect implementation in Omnibox in Google Chrome on iOS prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

Vendor-Debian GNU/Linux openSUSE Red Hat, Inc.Fedora Project Google LLC Apple Inc.SUSE

Product-enterprise_linux_server iphone_os debian_linux chrome linux_enterprise enterprise_linux_workstation fedora package_hub backports_sle enterprise_linux_desktop Chrome

CVE-2021-1872

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.30% / 53.87%

7 Day CHG~0.00%

Published-08 Sep, 2021 | 14:47

Updated-03 Aug, 2024 | 16:25

A logic issue was addressed with improved state management. This issue is fixed in iOS 14.5 and iPadOS 14.5, watchOS 7.4, macOS Big Sur 11.3. Muting a CallKit call while ringing may not result in mute being enabled.

Vendor-Apple Inc.

Product-iphone_os macos ipados watchOS macOS iOS and iPadOS

CVE-2025-43228

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.07% / 21.64%

7 Day CHG+0.01%

Published-29 Jul, 2025 | 23:35

Updated-02 Apr, 2026 | 19:20

The issue was addressed with improved UI. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6. Visiting a malicious website may lead to address bar spoofing.

Vendor-Apple Inc.

Product-iphone_os safari ipados Safari iOS and iPadOS

CWE ID-CWE-451

User Interface (UI) Misrepresentation of Critical Information

CVE-2026-5897

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 8.33%

7 Day CHG~0.00%

Published-08 Apr, 2026 | 21:20

Updated-13 Apr, 2026 | 21:17

Incorrect security UI in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

CWE ID-CWE-451

User Interface (UI) Misrepresentation of Critical Information

CVE-2026-5887

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.04% / 11.44%

7 Day CHG~0.00%

Published-08 Apr, 2026 | 21:20

Updated-13 Apr, 2026 | 21:17

Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to bypass download restrictions via a crafted HTML page. (Chromium security severity: Medium)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

CWE ID-CWE-20

Improper Input Validation

CVE-2026-5911

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.04% / 11.04%

7 Day CHG+0.01%

Published-08 Apr, 2026 | 21:21

Updated-10 May, 2026 | 21:16

Policy bypass in ServiceWorkers in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)

Vendor-Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation

Product-chrome windows linux_kernel macos Chrome

CWE ID-CWE-693

Protection Mechanism Failure

CVE-2026-5898

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 8.33%

7 Day CHG~0.00%

Published-08 Apr, 2026 | 21:20

Updated-13 Apr, 2026 | 21:17

Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

CWE ID-CWE-451

User Interface (UI) Misrepresentation of Critical Information

CVE-2026-5894

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.02% / 6.53%

7 Day CHG~0.00%

Published-08 Apr, 2026 | 21:20

Updated-14 Apr, 2026 | 17:06

Inappropriate implementation in PDF in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

CWE ID-CWE-358

Improperly Implemented Security Check for Standard

CVE-2026-5882

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 9.01%

7 Day CHG~0.00%

Published-08 Apr, 2026 | 21:20

Updated-14 Apr, 2026 | 20:01

Incorrect security UI in Fullscreen in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

CWE ID-CWE-451

User Interface (UI) Misrepresentation of Critical Information

CVE-2026-5878

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 9.01%

7 Day CHG~0.00%

Published-08 Apr, 2026 | 21:20

Updated-14 Apr, 2026 | 20:02

Incorrect security UI in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

CWE ID-CWE-451

User Interface (UI) Misrepresentation of Critical Information

CVE-2026-5906

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 9.01%

7 Day CHG~0.00%

Published-08 Apr, 2026 | 21:21

Updated-14 Apr, 2026 | 14:51

Incorrect security UI in Omnibox in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

CWE ID-CWE-451

User Interface (UI) Misrepresentation of Critical Information

CVE-2026-5900

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 10.19%

7 Day CHG~0.00%

Published-08 Apr, 2026 | 21:20

Updated-13 Apr, 2026 | 21:14

Policy bypass in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass of multi-download protections via a crafted HTML page. (Chromium security severity: Low)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

CWE ID-CWE-693

Protection Mechanism Failure

CVE-2020-9987

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.28% / 51.89%

7 Day CHG~0.00%

Published-08 Dec, 2020 | 19:29

Updated-04 Aug, 2024 | 10:50

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 14.0. Visiting a malicious website may lead to address bar spoofing.

Vendor-Apple Inc.

Product-safari Safari

CWE ID-CWE-1021

Improper Restriction of Rendered UI Layers or Frames

CVE-2026-3925

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 7.54%

7 Day CHG~0.00%

Published-11 Mar, 2026 | 22:04

Updated-13 Mar, 2026 | 20:15

Incorrect security UI in LookalikeChecks in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

CWE ID-CWE-451

User Interface (UI) Misrepresentation of Critical Information

CVE-2026-3941

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-4.3||MEDIUM

EPSS-0.04% / 11.04%

7 Day CHG~0.00%

Published-11 Mar, 2026 | 22:04

Updated-13 Mar, 2026 | 15:41

Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

CWE ID-CWE-602

Client-Side Enforcement of Server-Side Security

CVE-2026-3935

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 8.25%

7 Day CHG~0.00%

Published-11 Mar, 2026 | 22:04

Updated-16 Mar, 2026 | 18:14

Incorrect security UI in WebAppInstalls in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

CWE ID-CWE-451

User Interface (UI) Misrepresentation of Critical Information

CVE-2026-3927

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 9.01%

7 Day CHG~0.00%

Published-11 Mar, 2026 | 22:04

Updated-13 Mar, 2026 | 20:15

Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc