cve.bz

CWE-1007: Insufficient Visual Distinction of Homoglyphs Presented to User

Filter

The product displays information or identifiers to a user, but the display mechanism does not make it easy for the user to distinguish between visually similar or identical glyphs (homoglyphs), which may cause the user to misinterpret a glyph and perform an unintended, insecure action.

What the weakness is: CWE-1007 at MITRE. All weaknesses

Related attack patterns (CAPEC): 1
  • CAPEC-632 Homograph Attack via Homoglyphs Likelihood: Low · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-1007, as MITRE names them. Credits.

Ask an AI about CWE-1007

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-1007: Insufficient Visual Distinction of Homoglyphs Presented to User and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1007.html and https://cve.bz/cve/cwe/1007?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2026-48760EPSS 0.3%

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::parse() rejected raw BiDi formatting characters but not percent-encoded forms and …

  2. 2.3CVE-2026-45064EPSS 0.3%

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse() passes Unicode explicit-direction BiDi formatting characters through…

  3. 8.7CVE-2025-27611EPSS 0.4%

    base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vulnerable to attackers potentially deceiving users into sending funds to an unint…

  4. 5.4CVE-2025-0996EPSS 0.4%

    Inappropriate implementation in Browser UI in Google Chrome on Android prior to 133.0.6943.98 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)

  5. 4.3CVE-2021-4221EPSS 0.4%

    If a domain name contained a RTL character, it would cause the domain to be rendered to the right of the path. This could lead to user confusion and spoofing attacks. <br>*This bug only affects Firefox for Android. Other operating systems …