Monthly
Clickjacking in Firefox's DOM Events component allows an unauthenticated remote attacker to redirect a victim's browser interactions from an overlaid or framed context, resulting in limited confidentiality and integrity impact across an origin boundary. All Firefox versions prior to 155 and Firefox ESR versions prior to 153.2 are affected, per multiple Mozilla security advisories (mfsa2026-82, mfsa2026-85, mfsa2026-86, mfsa2026-88). No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) reflects very low observed exploitation probability.
Clickjacking vulnerability in the Ebyte NE2-D11 industrial IoT device web management interface enables a remote unauthenticated attacker to embed the administrative UI within a crafted external webpage. By luring an authenticated administrator to visit the malicious page, an attacker can trick that administrator into submitting unintended configuration changes or triggering disruptive actions against the device. Reported by CISA ICS-CERT under advisory ICSA-26-237-06; no public exploit identified at time of analysis.
Address bar spoofing in ArcSearch for iOS prior to 1.48.0 allows attacker-controlled web content to impersonate trusted browser interface elements by triggering a page-initiated scroll that keeps the address bar hidden. The Scope Change in the CVSS vector (S:C) reflects that the vulnerability crosses from web content into the browser chrome itself, enabling phishing and credential harvesting attacks. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and lack of required privileges make this straightforward to weaponize against any user who visits a malicious page.
Clickjacking in Firefox for Android's Downloads component enables remote attackers to trick users into performing unintended download-related actions through UI redress. All Firefox for Android versions prior to 154 are affected, with the fix confirmed in Mozilla Security Advisory mfsa2026-74. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) reflects very low observed exploitation probability.
Clickjacking in Mozilla Firefox's Widget component enables a remote unauthenticated attacker to trick users into triggering high-impact unintended browser actions through overlaid UI deception. All Firefox desktop releases prior to version 154 - and all ESR releases prior to 153.1 - are affected across platforms per CPE cpe:2.3:a:mozilla:firefox:*. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and zero authentication requirement make this a credible risk for any organization deploying Firefox at scale.
Information disclosure via the WebRTC component in Mozilla Firefox allows network-accessible attackers to exfiltrate sensitive browser data due to improper restriction of rendered UI layers (CWE-1021). All Firefox releases prior to version 154 and all Firefox ESR releases prior to version 153.1 are affected across all platforms listed under CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. The CVSS base score is 7.5 with high confidentiality impact; SSVC confirms automatable exploitation, though no active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Clickjacking in Firefox for Android before version 154 allows remote unauthenticated attackers to overlay transparent or opaque UI frames over legitimate browser content, capturing user interactions intended for other elements. The CVSS vector (PR:N, UI:R, I:H) indicates no privileges are needed but a victim must interact with an attacker-controlled page, resulting in high-integrity impact through unintended user actions such as inadvertent permission grants or form submissions. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
SAP Data Services Management Console versions 4.3 and 2025 expose an overly permissive Content Security Policy that omits key restrictive directives, creating a prerequisite condition for script injection attacks within the application context. An authenticated attacker who also controls or exploits a separate vulnerability - such as a stored or reflected XSS vector - can leverage the absent CSP controls to execute malicious scripts in a victim user's browser session. Confidentiality and integrity suffer limited impact; availability is unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-origin iframe autofill popup positioning in Electron allows a malicious iframe to render the native autofill popup outside its own bounds, overlapping the embedding application's trusted UI and enabling clickjacking or UI spoofing attacks. Affected are only Electron applications that deliberately embed untrusted cross-origin iframes within windows that also present trusted native UI - apps without such patterns are explicitly not at risk. No public exploit code has been identified at time of analysis, and the vendor-confirmed CVSS score of 3.1 (Low) reflects the high attack complexity and constrained impact, though the nature of the spoofing risk makes it qualitatively more dangerous than the score alone suggests for vulnerable app architectures.
Full takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0, is possible via its Centralized Thirdparty Jars component. A low-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability, though the attack is rated difficult to execute (high attack complexity). No public exploit identified at time of analysis and the flaw is not in CISA KEV, but it was disclosed by Oracle in the July 2026 Critical Patch Update.
Clickjacking in Firefox's DOM Events component allows an unauthenticated remote attacker to redirect a victim's browser interactions from an overlaid or framed context, resulting in limited confidentiality and integrity impact across an origin boundary. All Firefox versions prior to 155 and Firefox ESR versions prior to 153.2 are affected, per multiple Mozilla security advisories (mfsa2026-82, mfsa2026-85, mfsa2026-86, mfsa2026-88). No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) reflects very low observed exploitation probability.
Clickjacking vulnerability in the Ebyte NE2-D11 industrial IoT device web management interface enables a remote unauthenticated attacker to embed the administrative UI within a crafted external webpage. By luring an authenticated administrator to visit the malicious page, an attacker can trick that administrator into submitting unintended configuration changes or triggering disruptive actions against the device. Reported by CISA ICS-CERT under advisory ICSA-26-237-06; no public exploit identified at time of analysis.
Address bar spoofing in ArcSearch for iOS prior to 1.48.0 allows attacker-controlled web content to impersonate trusted browser interface elements by triggering a page-initiated scroll that keeps the address bar hidden. The Scope Change in the CVSS vector (S:C) reflects that the vulnerability crosses from web content into the browser chrome itself, enabling phishing and credential harvesting attacks. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and lack of required privileges make this straightforward to weaponize against any user who visits a malicious page.
Clickjacking in Firefox for Android's Downloads component enables remote attackers to trick users into performing unintended download-related actions through UI redress. All Firefox for Android versions prior to 154 are affected, with the fix confirmed in Mozilla Security Advisory mfsa2026-74. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) reflects very low observed exploitation probability.
Clickjacking in Mozilla Firefox's Widget component enables a remote unauthenticated attacker to trick users into triggering high-impact unintended browser actions through overlaid UI deception. All Firefox desktop releases prior to version 154 - and all ESR releases prior to 153.1 - are affected across platforms per CPE cpe:2.3:a:mozilla:firefox:*. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and zero authentication requirement make this a credible risk for any organization deploying Firefox at scale.
Information disclosure via the WebRTC component in Mozilla Firefox allows network-accessible attackers to exfiltrate sensitive browser data due to improper restriction of rendered UI layers (CWE-1021). All Firefox releases prior to version 154 and all Firefox ESR releases prior to version 153.1 are affected across all platforms listed under CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. The CVSS base score is 7.5 with high confidentiality impact; SSVC confirms automatable exploitation, though no active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Clickjacking in Firefox for Android before version 154 allows remote unauthenticated attackers to overlay transparent or opaque UI frames over legitimate browser content, capturing user interactions intended for other elements. The CVSS vector (PR:N, UI:R, I:H) indicates no privileges are needed but a victim must interact with an attacker-controlled page, resulting in high-integrity impact through unintended user actions such as inadvertent permission grants or form submissions. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
SAP Data Services Management Console versions 4.3 and 2025 expose an overly permissive Content Security Policy that omits key restrictive directives, creating a prerequisite condition for script injection attacks within the application context. An authenticated attacker who also controls or exploits a separate vulnerability - such as a stored or reflected XSS vector - can leverage the absent CSP controls to execute malicious scripts in a victim user's browser session. Confidentiality and integrity suffer limited impact; availability is unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-origin iframe autofill popup positioning in Electron allows a malicious iframe to render the native autofill popup outside its own bounds, overlapping the embedding application's trusted UI and enabling clickjacking or UI spoofing attacks. Affected are only Electron applications that deliberately embed untrusted cross-origin iframes within windows that also present trusted native UI - apps without such patterns are explicitly not at risk. No public exploit code has been identified at time of analysis, and the vendor-confirmed CVSS score of 3.1 (Low) reflects the high attack complexity and constrained impact, though the nature of the spoofing risk makes it qualitatively more dangerous than the score alone suggests for vulnerable app architectures.
Full takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0, is possible via its Centralized Thirdparty Jars component. A low-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability, though the attack is rated difficult to execute (high attack complexity). No public exploit identified at time of analysis and the flaw is not in CISA KEV, but it was disclosed by Oracle in the July 2026 Critical Patch Update.