Threats tagged 'ghsa-59rh-729h-3ffx'

Maxthon Browser for Android versions before 7.5.8.103 have an address bar spoofing vulnerability. This flaw allows remote attackers to create a fake address bar during fullscreen mode, misleading users about the true origin of the web page. The vulnerability arises because the browser lacks a persistent fullscreen notification or trusted origin indicator when the Fullscreen API is used. Attackers can exploit this to display a counterfeit address bar showing a trusted domain while presenting attacker-controlled content, potentially tricking users into disclosing credentials via phishing.