cve.bz

CWE-451: User Interface (UI) Misrepresentation of Critical Information, page 2

Filter

The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

What the weakness is: CWE-451 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 5
  • CAPEC-98 Phishing Likelihood: High · Severity: Very High
  • CAPEC-154 Resource Location Spoofing Likelihood: Medium · Severity: Medium
  • CAPEC-163 Spear Phishing Likelihood: High · Severity: High
  • CAPEC-164 Mobile Phishing Likelihood: High · Severity: High
  • CAPEC-173 Action Spoofing Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-451, as MITRE names them. Credits.

Ask an AI about CWE-451

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-451: User Interface (UI) Misrepresentation of Critical Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/451.html and https://cve.bz/cve/cwe/451?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2026-113170EPSS 0.3%

    UI misrepresentation in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

  2. 9.6CVE-2026-113169EPSS 0.3%

    UI misrepresentation in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to spoof UI elements via a co-installed app. (Chromium security severity: Low)

  3. 8.8CVE-2026-113156EPSS 0.4%

    UI misrepresentation in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

  4. 8.8CVE-2026-113149EPSS 0.3%

    UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

  5. 8.8CVE-2026-113145EPSS 0.4%

    UI misrepresentation in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

  6. 9.6CVE-2026-113138EPSS 0.3%

    UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

  7. 8.8CVE-2026-113096EPSS 0.4%

    UI misrepresentation in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

  8. 8.8CVE-2026-113090EPSS 0.3%

    UI misrepresentation in Interstitials in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  9. 8.8CVE-2026-113088EPSS 0.4%

    UI misrepresentation in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

  10. 8.8CVE-2026-113080EPSS 0.3%

    UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted Chrome extension. (Chromium security severity: Low)

  11. 8.8CVE-2026-113079EPSS 0.3%

    UI misrepresentation in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Low)

  12. 8.8CVE-2026-113068EPSS 0.3%

    UI misrepresentation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

  13. 8.8CVE-2026-113067EPSS 0.3%

    UI misrepresentation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)

  14. 8.8CVE-2026-113060EPSS 0.3%

    UI misrepresentation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker leveraging social engineering to spoof UI elements via a malicious peripheral. (Chromium security severity: Medium)

  15. 8.8CVE-2026-113055EPSS 0.4%

    UI misrepresentation in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  16. 8.8CVE-2026-113046EPSS 0.3%

    UI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

  17. 8.8CVE-2026-113025EPSS 0.4%

    UI misrepresentation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

  18. 8.8CVE-2026-113009EPSS 0.3%

    UI misrepresentation in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  19. 8.8CVE-2026-112994EPSS 0.3%

    UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

  20. 5.1CVE-2026-109434EPSS 0.3%

    Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a per…

  21. 7.3CVE-2026-109747EPSS 0.3%

    Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

  22. 8.1CVE-2026-109736EPSS 0.3%

    Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  23. 8.5CVE-2026-109346EPSS 0.3%

    better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/…

  24. 5.4CVE-2026-106380EPSS 0.2%

    UI misrepresentation in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

  25. 5.4CVE-2026-106368EPSS 0.2%

    UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

  26. 5.4CVE-2026-106338EPSS 0.2%

    UI misrepresentation in PictureInPicture in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)

  27. 5.4CVE-2026-106337EPSS 0.2%

    UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  28. 5.4CVE-2026-106317EPSS 0.2%

    UI misrepresentation in FullScreen in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)

  29. 5.4CVE-2026-106316EPSS 0.2%

    UI misrepresentation in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)

  30. 5.4CVE-2026-106305EPSS 0.2%

    UI misrepresentation in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

  31. 5.4CVE-2026-106302EPSS 0.2%

    UI misrepresentation in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  32. 5.4CVE-2026-106285EPSS 0.2%

    UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

  33. 5.4CVE-2026-106282EPSS 0.2%

    UI misrepresentation in WebOTP in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  34. 5.4CVE-2026-106276EPSS 0.2%

    UI misrepresentation in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

  35. 5.4CVE-2026-106272EPSS 0.2%

    UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via crafted network traffic. (Chromium security severity: Low)

  36. 5.4CVE-2026-106265EPSS 0.2%

    UI misrepresentation in File in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  37. 5.4CVE-2026-106251EPSS 0.2%

    UI misrepresentation in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)

  38. 5.4CVE-2026-106236EPSS 0.2%

    UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)

  39. 5.4CVE-2026-106232EPSS 0.2%

    UI misrepresentation in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  40. 5.4CVE-2026-106229EPSS 0.2%

    UI misrepresentation in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

  41. 5.4CVE-2026-106209EPSS 0.3%

    UI misrepresentation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

  42. 5.4CVE-2026-106182EPSS 0.2%

    UI misrepresentation in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  43. 5.4CVE-2026-106179EPSS 0.2%

    UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

  44. 3.6CVE-2026-105043EPSS 0.1%

    MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will cause code execution.

  45. 5.4CVE-2026-102314EPSS 0.2%

    UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

  46. 4.3CVE-2026-102312EPSS 0.2%

    UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)

  47. 5.4CVE-2026-102305EPSS 0.2%

    UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

  48. 5.4CVE-2026-95363EPSS 0.2%

    UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  49. 4.8CVE-2026-95346EPSS 0.3%

    UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via crafted network traffic. (Chromium security severity: Medium)

  50. 5.4CVE-2026-95337EPSS 0.2%

    UI misrepresentation in Messages in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)