cve.bz

CWE-451: User Interface (UI) Misrepresentation of Critical Information, page 7

Filter

The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

What the weakness is: CWE-451 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 5
  • CAPEC-98 Phishing Likelihood: High · Severity: Very High
  • CAPEC-154 Resource Location Spoofing Likelihood: Medium · Severity: Medium
  • CAPEC-163 Spear Phishing Likelihood: High · Severity: High
  • CAPEC-164 Mobile Phishing Likelihood: High · Severity: High
  • CAPEC-173 Action Spoofing Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-451, as MITRE names them. Credits.

Ask an AI about CWE-451

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-451: User Interface (UI) Misrepresentation of Critical Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/451.html and https://cve.bz/cve/cwe/451?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2026-8964EPSS 0.3%

    Spoofing issue in the Popup Blocker component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

  2. 4.2CVE-2026-8584EPSS 0.1%

    Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

  3. 4.7CVE-2026-8565EPSS 0.1%

    Inappropriate implementation in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security s…

  4. 4.2CVE-2026-8564EPSS 0.2%

    Incorrect security UI in Downloads in Google Chrome on Android and Mac prior to 148.0.7778.168 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

  5. 5.4CVE-2026-8561EPSS 0.2%

    Incorrect security UI in Fullscreen in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

  6. 6.5CVE-2026-42891EPSS 0.3%

    User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

  7. 4.3CVE-2026-40416EPSS 0.3%

    User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

  8. 4.3CVE-2026-35429EPSS 0.5%

    User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

  9. 7.5CVE-2025-46311EPSS 0.2%

    An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2. An app may be able to access sensitive user data.

  10. 4.7CVE-2026-34258EPSS 0.2%

    SAPUI5 (Search UI) allows an unauthenticated attacker to manipulate specific URL parameters on the Search UI to include malicious content. Successful exploitation may mislead victim users into clicking and accessing attacker-controlled pag…

  11. 7.5CVE-2026-28964EPSS 0.3%

    An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may be able to access sensitive user data.

  12. 4.7CVE-2026-44659EPSS 0.2%

    Zen is a firefox-based browser. Prior to 1.19.12b, the ZEN Browser incorrectly truncates long hostnames in the address bar and shows only the attacker-controlled prefix of the subdomain, hiding the actual registrable domain (eTLD+1). As a …

  13. 5.4CVE-2026-8019EPSS 0.2%

    Insufficient policy enforcement in WebApp in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

  14. 5.4CVE-2026-8015EPSS 0.2%

    Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

  15. 5.4CVE-2026-8008EPSS 0.1%

    Inappropriate implementation in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: …

  16. 5.4CVE-2026-8006EPSS 0.1%

    Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severit…

  17. 5.4CVE-2026-7935EPSS 0.2%

    Inappropriate implementation in Speech in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

  18. 8.8CVE-2025-31951EPSS 0.2%

    HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability. A flaw in a component's input handling was identified that could permit unauthorized command execution.

  19. 3.3CVE-2026-35371EPSS 0.1%

    The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a na…

  20. 7.1CVE-2026-3861EPSS 0.3%

    LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potent…

  21. 5.4CVE-2026-33119EPSS 0.3%

    User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

  22. 4.3CVE-2026-33118EPSS 0.6%

    User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

  23. 4.3CVE-2026-5906EPSS 0.2%

    Incorrect security UI in Omnibox in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)

  24. 6.5CVE-2026-5905EPSS 0.2%

    Incorrect security UI in Permissions in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)

  25. 4.3CVE-2026-5898EPSS 0.2%

    Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

  26. 4.3CVE-2026-5897EPSS 0.2%

    Incorrect security UI in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

  27. 5.4CVE-2026-5895EPSS 0.2%

    Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. (Chromium security severity: Low)

  28. 4.3CVE-2026-5891EPSS 0.2%

    Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

  29. 4.3CVE-2026-5882EPSS 0.2%

    Incorrect security UI in Fullscreen in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

  30. 4.3CVE-2026-5880EPSS 0.2%

    Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium secu…

  31. 4.3CVE-2026-5878EPSS 0.2%

    Incorrect security UI in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

  32. 7.3CVE-2026-32971EPSS 0.3%

    OpenClaw before 2026.3.11 contains an approval-integrity vulnerability in node-host system.run approvals that displays extracted shell payloads instead of the executed argv. Attackers can place wrapper binaries and induce wrapper-shaped co…

  33. 6.5CVE-2026-3889EPSS 0.2%

    Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.

  34. 5.9CVE-2026-32318EPSS 0.08%

    Cryptomator for IOS offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 2.8.3, an integrity check vulnerability allows an attacker tamper with the vault configuration file leading to a man-in-t…

  35. 5.9CVE-2026-32317EPSS 0.07%

    Cryptomator for Android offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 1.12.3, an integrity check vulnerability allows an attacker tamper with the vault configuration file leading to a man…

  36. 5.9CVE-2026-32303EPSS 0.1%

    Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, an integrity check vulnerability allows an attacker to tamper with the vault configuration file leading to a man-in-the-middle vulnerability in Hub ke…

  37. 5.0CVE-2026-0385EPSS 0.2%

    Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability

  38. 4.3CVE-2026-3942EPSS 0.2%

    Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

  39. 6.5CVE-2026-3937EPSS 0.2%

    Incorrect security UI in Downloads in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

  40. 6.5CVE-2026-3935EPSS 0.2%

    Incorrect security UI in WebAppInstalls in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

  41. 4.3CVE-2026-3928EPSS 0.1%

    Insufficient policy enforcement in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security sever…

  42. 4.3CVE-2026-3927EPSS 0.2%

    Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

  43. 4.3CVE-2026-3925EPSS 0.2%

    Incorrect security UI in LookalikeChecks in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

  44. 4.3CVE-2026-2919EPSS 0.2%

    Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a _self navigation to an invalid port and triggering an iframe redirect, causing the UI to display a trusted domain without …

  45. 7.2CVE-2025-68277EPSS 0.2%

    OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, when a link is sent via Secure Messaging, clicking the link opens the website within the OpenEMR/Portal site. …

  46. 9.8CVE-2026-2634EPSS 0.4%

    Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controlled pages to be presented under spoofed domains. This vulnerability was fixed in…

  47. 7.1CVE-2026-26320EPSS 0.5%

    OpenClaw is a personal AI assistant. OpenClaw macOS desktop client registers the `openclaw://` URL scheme. For `openclaw://agent` deep links without an unattended `key`, the app shows a confirmation dialog that previously displayed only th…

  48. 5.3CVE-2026-1658EPSS 0.3%

    User Interface (UI) Misrepresentation of Critical Information vulnerability in OpenText™ Directory Services allows Cache Poisoning.  The vulnerability could be exploited by a bad actor to inject manipulated text into the OpenText applicat…

  49. 4.3CVE-2026-2032EPSS 0.2%

    Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof arbitrary HTML under a trusted domain. This vulnerability was fixed in Firefox for…

  50. 4.3CVE-2026-2323EPSS 0.2%

    Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)