cve.bz

CWE-1021: Improper Restriction of Rendered UI Layers or Frames

Filter

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

What the weakness is: CWE-1021 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 7
  • CAPEC-103 Clickjacking Likelihood: Medium · Severity: High
  • CAPEC-181 Flash File Overlay Severity: Medium
  • CAPEC-222 iFrame Overlay Likelihood: Medium · Severity: High
  • CAPEC-504 Task Impersonation Likelihood: Medium · Severity: High
  • CAPEC-506 Tapjacking Likelihood: Low · Severity: Low
  • CAPEC-587 Cross Frame Scripting (XFS) Severity: High
  • CAPEC-654 Credential Prompt Impersonation Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-1021, as MITRE names them. Credits.

Ask an AI about CWE-1021

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-1021: Improper Restriction of Rendered UI Layers or Frames and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1021.html and https://cve.bz/cve/cwe/1021?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.6CVE-2026-108536

    IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper restriction of rendered UI layers or frames.

  2. 5.1CVE-2026-108049EPSS 0.4%

    Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Fra…

  3. 5.3CVE-2026-119715EPSS 0.2%

    NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated interface because no X-Frame-Options or CSP frame-ancestors headers are sent. Attackers can overlay a signed-in user's session …

  4. 4.3CVE-2026-20942EPSS 0.6%

    Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

  5. 6.4CVE-2026-67079EPSS 0.2%

    HCL BigFix AEX is affected by a Clickjacking vulnerability, which could allow an attacker to embed the application within a malicious web page or iframe and trick users into performing unintended actions, potentially leading to unauthorize…

  6. 6.9CVE-2026-77062EPSS 0.5%

    The boneIO Black web interface lacks proper clickjacking protections. A remote attacker can embed the control panel in an iframe on a malicious web page and trick an authenticated user on the internal network into clicking buttons that act…

  7. 8.6CVE-2026-114125EPSS 0.4%

    Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook developme…

  8. 8.8CVE-2026-113063EPSS 0.3%

    Clickjacking in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)

  9. 3.5CVE-2026-60008EPSS 0.4%

    Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository note…

  10. 8.4CVE-2026-109290EPSS 0.3%

    Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk …

  11. 2.0CVE-2026-108901EPSS 0.2%

    A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in…

  12. 5.4CVE-2026-106400EPSS 0.2%

    Clickjacking in Messages in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  13. 5.4CVE-2026-106356EPSS 0.2%

    Clickjacking in EVP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  14. 5.4CVE-2026-106311EPSS 0.2%

    Clickjacking in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  15. 5.4CVE-2026-71177EPSS 0.2%

    Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low privileged attacker with remote access could potentially exploit this vul…

  16. 9.6CVE-2026-84388EPSS 0.4%

    A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions may allow attacker to information disclosure via remote unauthenticated…

  17. 5.5CVE-2026-86911EPSS 0.2%

    This issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. A malicious app may be able to bypass clickjacking protections for secure prompts.

  18. 7.8CVE-2026-43688EPSS 0.2%

    A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. Processing a maliciously crafted file may lead to unexpected app termination.

  19. 8.7CVE-2026-87995EPSS 0.4%

    Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-sc…

  20. 5.4CVE-2026-87655EPSS 0.2%

    Clickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  21. 4.2CVE-2026-87538EPSS 0.2%

    Clickjacking in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Lo…

  22. 4.0CVE-2026-87486EPSS 0.1%

    Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to spoof address bar via a co-installed app. (Chromium security severity: Medium)

  23. 7.3CVE-2026-28656EPSS 0.09%

    In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is ne…

  24. 6.1CVE-2026-84139EPSS 0.3%

    Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

  25. 5.3CVE-2026-75548EPSS 0.3%

    The affected Ebyte device web management interface does not restrict the interface from being rendered within an external frame. An unauthenticated remote attacker could use a crafted webpage to mislead an authenticated administrator in…

  26. 7.4CVE-2026-18534EPSS 0.3%

    ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk.

  27. 6.5CVE-2026-74980EPSS 0.3%

    Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.

  28. 8.1CVE-2026-74978EPSS 0.4%

    Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

  29. 7.5CVE-2026-74958EPSS 0.5%

    Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

  30. 6.5CVE-2026-74951EPSS 0.3%

    Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154.

  31. 3.7CVE-2026-44762EPSS 0.2%

    SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks certain restrictive directives, which could enable an authenticated malicious user to leverage this weakness in combinat…

  32. 7.2CVE-2026-70608EPSS 0.4%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger set…

  33. 4.3CVE-2026-70600EPSS 0.2%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the native autofill popup could be positioned by a cross-origin iframe outside that…

  34. 5.4CVE-2026-70486EPSS 0.4%

    Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files ser…

  35. 7.1CVE-2026-47723EPSS 0.5%

    nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in `internal/web/` or `internal/api/` set the standard browser-security headers. `grep` for `Conte…

  36. 7.5CVE-2026-60370EPSS 0.3%

    Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability a…

  37. 6.5CVE-2026-16397EPSS 0.3%

    Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.

  38. 6.1CVE-2026-40957EPSS 0.4%

    o   CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers with control of a malicious web site could use it to potentially steal credentials from an unwary administrator.

  39. 8.1CVE-2026-58595EPSS 0.7%

    Improper restriction of rendered ui layers or frames in Microsoft Bing App for IOS allows an unauthorized attacker to perform spoofing over a network.

  40. 3.5CVE-2026-59791EPSS 0.2%

    In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible

  41. 5.4CVE-2026-38979EPSS 0.3%

    ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. In ajenti-core/aj/http.py, the core HTTP response path initializes an empty header list, forwards handler-added headers verbatim, and fin…

  42. 5.4CVE-2026-14142EPSS 0.2%

    Inappropriate implementation in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

  43. 4.3CVE-2026-14110EPSS 0.2%

    Inappropriate implementation in DarkMode in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

  44. 9.3CVE-2026-44727EPSS 0.4%

    Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Poli…

  45. 7.4CVE-2026-12348EPSS 0.3%

    Address bar spoofing in Arc Search for Android allows a remote attacker to display a trusted domain in the address bar while rendering attacker-controlled content, enabling phishing.

  46. 5.4CVE-2026-12323EPSS 0.2%

    Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

  47. 5.4CVE-2026-12322EPSS 0.2%

    Clickjacking issue in the Widget: Gtk component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

  48. 4.3CVE-2026-10733EPSS 0.2%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that could have allowed an authenticated user to cause denial of service on the CI/CD Catalog page…

  49. 7.8CVE-2026-28577EPSS 0.07%

    In addWindow of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not ne…

  50. 5.9CVE-2026-0061EPSS 0.1%

    In multiple functions of WindowState.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges nee…