Maxthon Browser CVE-2026-119730

Exploitation requires that the victim visit an attacker-controlled page using an affected Maxthon Browser for Android version (before 7.5.8.103) and then perform a single tap, which the page uses to invoke the Fullscreen API; the flaw is the absence of a persistent fullscreen notification or trusted-origin indicator in that mode. Limiting factors: success depends on active user interaction (the tap and subsequent credential entry into a spoofed address bar), so it is a phishing/social-engineering enabler rather than automated compromise; it is confined to the Maxthon Android client, and no system confidentiality or availability is directly affected. There is no authentication requirement (PR:N), but user deception is essential.

This is a genuinely medium/low-priority issue, not a high-CVSS overstatement. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N) scores 5.1 and is internally consistent with the description: network-reachable, no authentication, but requiring active user interaction (a single tap to enter fullscreen) and producing only a low integrity impact (origin misrepresentation) with no confidentiality or availability impact to the system itself. Exploitation status: no public exploit identified at time of analysis - the only non-patch reference is the VulnCheck advisory, which is not presented as working exploit code, and there is no CISA KEV listing and no EPSS score supplied. The vuln.today decision label is 'this_month', i.e. patch on a routine cycle rather than emergency. Because this is a spoofing/phishing-enablement flaw (CWE-451) whose real-world damage depends entirely on social engineering a user into entering credentials, the raw CVSS understates nothing but also overstates nothing - the actual harm is contingent on user deception, not direct technical compromise. EPSS and KEV data are absent, so widespread automated exploitation cannot be inferred; this is best treated as a deception primitive rather than a critical breach vector.

An attacker hosts a malicious web page and lures a Maxthon for Android user to it. When the user performs a single tap, the page invokes the Fullscreen API; because the browser (before 7.5.8.103) shows no persistent fullscreen notification or trusted-origin indicator, the page renders a counterfeit address bar displaying a trusted domain over attacker-controlled content, prompting the victim to enter credentials into a phishing form. No working public exploit is identified; only a VulnCheck advisory describing the issue is referenced.