Maxthon Browser for Android < 7.5.8.103 Fullscreen Address Bar Spoofing
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 7.5.8.103
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The affected software is the Maxthon Browser for Android. The flaw lets a malicious web page display a fake address bar when fullscreen mode is entered, so users can be tricked into believing they are on a trusted site and entering their credentials into a phishing page.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote attackers to misrepresent a page's origin by exploiting the lack of a persistent fullscreen notification or trusted origin indicator when the Fullscreen API is invoked. Attackers can craft a malicious web page that renders a counterfeit address bar showing a trusted domain while displaying attacker-controlled content, tricking users who perform a single tap to enter fullscreen into disclosing credentials via phishing.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Maxthon Technology Limited Maxthon Browser for Android
fixed in 7.5.8.103