Monthly
UI redress (clickjacking) in the Fortinet FortiPAM Chrome Extension allows an attacker-controlled web page to frame or overlay the extension's rendered interface so that a victim's clicks are redirected into unintended, privileged extension actions, resulting in information disclosure with limited integrity impact. The affected code is the 7.4 branch and the 8.0 builds through 8.0.0 as scoped by Fortinet advisory FG-IR-26-168 (the vendor description covers all 8.0 and 7.4 versions, while ENISA EUVD specifically lists 8.0.1). Exploitation is remote and unauthenticated from the attacker's side (PR:N, CVSS:3.1/AV:N/AC:L/S:C) but is gated by required victim interaction (UI:R) - the user must have the vulnerable extension installed and be lured into clicking within an attacker-planted frame, which materially limits real-world exploitability despite Fortinet's 9.6 score; no public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and the assessed impact (C:H/I:L/A:N) is lower than the vendor rating.
Memory corruption during file parsing on Apple iOS/iPadOS (before version 27) and macOS (before Golden Gate 27) can cause the handling application to terminate unexpectedly when a user opens a maliciously crafted file; the flaw was addressed by strengthening input validation. Because the attack vector is local (the file must be delivered to and opened on the device) and user interaction is required, exploitation is not remote or unattended, and no special privileges are needed (PR:N, unauthenticated). The vendor rates this 7.8 High, but the independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects availability-only impact, and combined with a very low EPSS of 0.19% (8th percentile) and no public exploit identified at time of analysis, real-world risk is LOW-to-MODERATE rather than critical.
Tapjacking vulnerability in Android's DeviceAdminAdd.java enables a locally-installed malicious application to render a transparent overlay over the device administrator enrollment screen, coercing users into unknowingly granting device admin privileges. Affected versions span Android 14, 15, 16, and 16-QPR2, covering a broad swath of current Android devices. Successful exploitation grants the attacker app full device administrator rights, enabling complete confidentiality, integrity, and availability compromise of the victim device. No public exploit exists and EPSS is at the 2nd percentile; SSVC rates technical impact as total but exploitation as none.
Address bar spoofing in ArcSearch for iOS prior to 1.48.0 allows attacker-controlled web content to impersonate trusted browser interface elements by triggering a page-initiated scroll that keeps the address bar hidden. The Scope Change in the CVSS vector (S:C) reflects that the vulnerability crosses from web content into the browser chrome itself, enabling phishing and credential harvesting attacks. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and lack of required privileges make this straightforward to weaponize against any user who visits a malicious page.
Clickjacking in Mozilla Firefox's Widget component enables a remote unauthenticated attacker to trick users into triggering high-impact unintended browser actions through overlaid UI deception. All Firefox desktop releases prior to version 154 - and all ESR releases prior to 153.1 - are affected across platforms per CPE cpe:2.3:a:mozilla:firefox:*. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and zero authentication requirement make this a credible risk for any organization deploying Firefox at scale.
Information disclosure via the WebRTC component in Mozilla Firefox allows network-accessible attackers to exfiltrate sensitive browser data due to improper restriction of rendered UI layers (CWE-1021). All Firefox releases prior to version 154 and all Firefox ESR releases prior to version 153.1 are affected across all platforms listed under CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. The CVSS base score is 7.5 with high confidentiality impact; SSVC confirms automatable exploitation, though no active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Full takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0, is possible via its Centralized Thirdparty Jars component. A low-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability, though the attack is rated difficult to execute (high attack complexity). No public exploit identified at time of analysis and the flaw is not in CISA KEV, but it was disclosed by Oracle in the July 2026 Critical Patch Update.
Spoofing in the Microsoft Bing Search app for iOS lets a remote attacker present deceptive or overlaid UI content that misleads the victim, because the app improperly restricts how rendered UI layers or frames are displayed (CWE-1021, a UI-redressing/clickjacking class of flaw). An unauthenticated attacker who lures a user into interacting with attacker-controlled content can manipulate what the user sees and trusts, potentially inducing them to act on falsified information. Microsoft has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Address bar spoofing in The Browser Company's Arc Search for Android allows remote attackers to render attacker-controlled content beneath a legitimate-looking URL in the address bar, enabling high-fidelity phishing against mobile users. The flaw maps to CWE-1021 (improper restriction of rendered UI layers) and carries a CVSS 7.4 due to the integrity impact on user trust decisions, though successful exploitation requires user interaction. No public exploit identified at time of analysis, but a HackerOne report (#3705306) suggests reproducible POC details exist within the disclosure program.
Clickjacking and browser-hardening weaknesses in juev/nebula-mesh (forgekeep/nebula-mesh) admin UI and API affect all releases up to and including v0.3.0, because no response path in internal/web/ or internal/api/ emits standard security headers. An attacker who lures an authenticated operator to a malicious page can frame the admin console and hijack high-value actions — signing CA certificates, minting API keys, and managing operators — since X-Frame-Options/CSP frame-ancestors are absent. No public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile), but a vendor patch (v0.3.1) is available.
UI redress (clickjacking) in the Fortinet FortiPAM Chrome Extension allows an attacker-controlled web page to frame or overlay the extension's rendered interface so that a victim's clicks are redirected into unintended, privileged extension actions, resulting in information disclosure with limited integrity impact. The affected code is the 7.4 branch and the 8.0 builds through 8.0.0 as scoped by Fortinet advisory FG-IR-26-168 (the vendor description covers all 8.0 and 7.4 versions, while ENISA EUVD specifically lists 8.0.1). Exploitation is remote and unauthenticated from the attacker's side (PR:N, CVSS:3.1/AV:N/AC:L/S:C) but is gated by required victim interaction (UI:R) - the user must have the vulnerable extension installed and be lured into clicking within an attacker-planted frame, which materially limits real-world exploitability despite Fortinet's 9.6 score; no public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and the assessed impact (C:H/I:L/A:N) is lower than the vendor rating.
Memory corruption during file parsing on Apple iOS/iPadOS (before version 27) and macOS (before Golden Gate 27) can cause the handling application to terminate unexpectedly when a user opens a maliciously crafted file; the flaw was addressed by strengthening input validation. Because the attack vector is local (the file must be delivered to and opened on the device) and user interaction is required, exploitation is not remote or unattended, and no special privileges are needed (PR:N, unauthenticated). The vendor rates this 7.8 High, but the independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects availability-only impact, and combined with a very low EPSS of 0.19% (8th percentile) and no public exploit identified at time of analysis, real-world risk is LOW-to-MODERATE rather than critical.
Tapjacking vulnerability in Android's DeviceAdminAdd.java enables a locally-installed malicious application to render a transparent overlay over the device administrator enrollment screen, coercing users into unknowingly granting device admin privileges. Affected versions span Android 14, 15, 16, and 16-QPR2, covering a broad swath of current Android devices. Successful exploitation grants the attacker app full device administrator rights, enabling complete confidentiality, integrity, and availability compromise of the victim device. No public exploit exists and EPSS is at the 2nd percentile; SSVC rates technical impact as total but exploitation as none.
Address bar spoofing in ArcSearch for iOS prior to 1.48.0 allows attacker-controlled web content to impersonate trusted browser interface elements by triggering a page-initiated scroll that keeps the address bar hidden. The Scope Change in the CVSS vector (S:C) reflects that the vulnerability crosses from web content into the browser chrome itself, enabling phishing and credential harvesting attacks. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and lack of required privileges make this straightforward to weaponize against any user who visits a malicious page.
Clickjacking in Mozilla Firefox's Widget component enables a remote unauthenticated attacker to trick users into triggering high-impact unintended browser actions through overlaid UI deception. All Firefox desktop releases prior to version 154 - and all ESR releases prior to 153.1 - are affected across platforms per CPE cpe:2.3:a:mozilla:firefox:*. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and zero authentication requirement make this a credible risk for any organization deploying Firefox at scale.
Information disclosure via the WebRTC component in Mozilla Firefox allows network-accessible attackers to exfiltrate sensitive browser data due to improper restriction of rendered UI layers (CWE-1021). All Firefox releases prior to version 154 and all Firefox ESR releases prior to version 153.1 are affected across all platforms listed under CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. The CVSS base score is 7.5 with high confidentiality impact; SSVC confirms automatable exploitation, though no active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Full takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0, is possible via its Centralized Thirdparty Jars component. A low-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability, though the attack is rated difficult to execute (high attack complexity). No public exploit identified at time of analysis and the flaw is not in CISA KEV, but it was disclosed by Oracle in the July 2026 Critical Patch Update.
Spoofing in the Microsoft Bing Search app for iOS lets a remote attacker present deceptive or overlaid UI content that misleads the victim, because the app improperly restricts how rendered UI layers or frames are displayed (CWE-1021, a UI-redressing/clickjacking class of flaw). An unauthenticated attacker who lures a user into interacting with attacker-controlled content can manipulate what the user sees and trusts, potentially inducing them to act on falsified information. Microsoft has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Address bar spoofing in The Browser Company's Arc Search for Android allows remote attackers to render attacker-controlled content beneath a legitimate-looking URL in the address bar, enabling high-fidelity phishing against mobile users. The flaw maps to CWE-1021 (improper restriction of rendered UI layers) and carries a CVSS 7.4 due to the integrity impact on user trust decisions, though successful exploitation requires user interaction. No public exploit identified at time of analysis, but a HackerOne report (#3705306) suggests reproducible POC details exist within the disclosure program.
Clickjacking and browser-hardening weaknesses in juev/nebula-mesh (forgekeep/nebula-mesh) admin UI and API affect all releases up to and including v0.3.0, because no response path in internal/web/ or internal/api/ emits standard security headers. An attacker who lures an authenticated operator to a malicious page can frame the admin console and hijack high-value actions — signing CA certificates, minting API keys, and managing operators — since X-Frame-Options/CSP frame-ancestors are absent. No public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile), but a vendor patch (v0.3.1) is available.