Monthly
Better Auth versions 1.3.8-beta.3 to before 1.7.0-rc.3 with the deviceAuthorization plugin enabled are vulnerable to a UI misrepresentation flaw (CWE-451) in which the GET /device approval screen omits the requesting client_id and scope, letting unauthenticated remote attackers initiate a device code and trick a signed-in user into approving it, resulting in a live session token. Exploitation requires user interaction and is not actively exploited; no public exploit identified at time of analysis, and the independent assessment rates it as a credible but not critical-severity risk.
UI spoofing in Arc Search for Android before 1.12.10 lets an unauthenticated remote attacker use a crafted webpage that enters fullscreen while the app is backgrounded to suppress the return-from-background fullscreen notification and render fake browser UI, such as a spoofed address bar. The victim must visit the attacker-controlled page and be deceived by the spoofed origin, so exploitation requires user interaction and carries no confidentiality or availability impact, though integrity impact is high for phishing. No CISA KEV listing or public exploit code was identified at time of analysis; CVSS 3.1 base score is 7.4 (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).
Address bar spoofing in Arc Browser lets remote, unauthenticated attackers paint a convincing fake address bar over the genuine browser chrome by embedding a <select> element on an attacker-controlled page that invokes the Fullscreen API; because Arc fails to display the expected fullscreen notification, the victim never gets the visual cue that would normally reveal the browser is in a special display state. Exploitation is gated on user interaction - the victim must open the malicious page and engage with the select element - and the outcome is deception/phishing rather than code execution or direct data access, which is why the authoritative assessment lowers the integrity impact to I:L instead of the I:H in the widely-cited 7.4 vector. No public exploit code and no confirmed active exploitation were identified at time of analysis.
UI misrepresentation in Google Chrome's Browser component prior to 152.0.7977.65 enables a remote attacker to bypass system access restrictions through a crafted HTML page combined with social engineering. The flaw (CWE-451) allows the browser to render misleading UI elements that deceive users into believing they are interacting with a trusted context, enabling restriction bypasses with high confidentiality and integrity impact. No public exploit code or CISA KEV listing exists at time of analysis; vendor patch is available.
UI spoofing in Google Chrome for Android before 150.0.7871.47 lets a local attacker misrepresent browser interface elements through the WebAppInstalls component using a malicious file. The flaw (CWE-451) requires a crafted file to be opened on the device and could deceive users into trusting spoofed content or install prompts. Google rates the Chromium security severity as Low, no public exploit has been identified, and EPSS is negligible at 0.11%.
Command approval bypass in OpenClaw versions prior to 2026.5.18 allows authenticated users to smuggle malicious instructions past human approvers by exploiting how the approval UI truncates oversized exec commands. The flaw (CWE-451, UI misrepresentation) lets an attacker craft a request with a benign-looking prefix while a malicious suffix is hidden from the reviewer's display, resulting in unauthorized execution once the request is approved. No public exploit identified at time of analysis and the CVE is not currently listed in CISA KEV.
UI spoofing in Google Chrome for Android prior to 149.0.7827.53 allows remote attackers to deceive users via crafted HTML pages that abuse the Messages component's security UI. Exploitation requires user interaction with a malicious page, and no public exploit has been identified at time of analysis. Despite a CVSS score of 8.8, EPSS exploitation probability is very low (0.03%, 11th percentile) and the issue is rated Medium by Chromium's own severity scale.
UI spoofing in Google Chrome on Android prior to 149.0.7827.53 allows remote attackers to misrepresent the Contact Picker security UI via a crafted HTML page, potentially tricking users into disclosing contact information. Chromium rates the underlying severity as Medium, and no public exploit has been identified at time of analysis. EPSS probability is very low (0.03%), and the issue is not listed in CISA KEV.
Local privilege escalation in Android 16 and Android 16-qpr2 allows a low-privileged app to deceive the user into forgetting a paired Bluetooth or companion device via a misleading UI in the ForgetDeviceDialogFragment. No public exploit identified at time of analysis, and CISA SSVC marks exploitation status as 'none' with total technical impact. The flaw is a UI spoofing weakness (CWE-451) reachable without any user interaction beyond normal dialog acknowledgement.
Local privilege escalation in Android 14 through 16-qpr2 stems from misleading UI rendering in KeyChainActivity's getApplicationLabel function, which can deceive users into granting certificate access to a malicious application. SSVC indicates no observed exploitation and the attack is not automatable, but technical impact is rated total, and no public exploit was identified at time of analysis.
Better Auth versions 1.3.8-beta.3 to before 1.7.0-rc.3 with the deviceAuthorization plugin enabled are vulnerable to a UI misrepresentation flaw (CWE-451) in which the GET /device approval screen omits the requesting client_id and scope, letting unauthenticated remote attackers initiate a device code and trick a signed-in user into approving it, resulting in a live session token. Exploitation requires user interaction and is not actively exploited; no public exploit identified at time of analysis, and the independent assessment rates it as a credible but not critical-severity risk.
UI spoofing in Arc Search for Android before 1.12.10 lets an unauthenticated remote attacker use a crafted webpage that enters fullscreen while the app is backgrounded to suppress the return-from-background fullscreen notification and render fake browser UI, such as a spoofed address bar. The victim must visit the attacker-controlled page and be deceived by the spoofed origin, so exploitation requires user interaction and carries no confidentiality or availability impact, though integrity impact is high for phishing. No CISA KEV listing or public exploit code was identified at time of analysis; CVSS 3.1 base score is 7.4 (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).
Address bar spoofing in Arc Browser lets remote, unauthenticated attackers paint a convincing fake address bar over the genuine browser chrome by embedding a <select> element on an attacker-controlled page that invokes the Fullscreen API; because Arc fails to display the expected fullscreen notification, the victim never gets the visual cue that would normally reveal the browser is in a special display state. Exploitation is gated on user interaction - the victim must open the malicious page and engage with the select element - and the outcome is deception/phishing rather than code execution or direct data access, which is why the authoritative assessment lowers the integrity impact to I:L instead of the I:H in the widely-cited 7.4 vector. No public exploit code and no confirmed active exploitation were identified at time of analysis.
UI misrepresentation in Google Chrome's Browser component prior to 152.0.7977.65 enables a remote attacker to bypass system access restrictions through a crafted HTML page combined with social engineering. The flaw (CWE-451) allows the browser to render misleading UI elements that deceive users into believing they are interacting with a trusted context, enabling restriction bypasses with high confidentiality and integrity impact. No public exploit code or CISA KEV listing exists at time of analysis; vendor patch is available.
UI spoofing in Google Chrome for Android before 150.0.7871.47 lets a local attacker misrepresent browser interface elements through the WebAppInstalls component using a malicious file. The flaw (CWE-451) requires a crafted file to be opened on the device and could deceive users into trusting spoofed content or install prompts. Google rates the Chromium security severity as Low, no public exploit has been identified, and EPSS is negligible at 0.11%.
Command approval bypass in OpenClaw versions prior to 2026.5.18 allows authenticated users to smuggle malicious instructions past human approvers by exploiting how the approval UI truncates oversized exec commands. The flaw (CWE-451, UI misrepresentation) lets an attacker craft a request with a benign-looking prefix while a malicious suffix is hidden from the reviewer's display, resulting in unauthorized execution once the request is approved. No public exploit identified at time of analysis and the CVE is not currently listed in CISA KEV.
UI spoofing in Google Chrome for Android prior to 149.0.7827.53 allows remote attackers to deceive users via crafted HTML pages that abuse the Messages component's security UI. Exploitation requires user interaction with a malicious page, and no public exploit has been identified at time of analysis. Despite a CVSS score of 8.8, EPSS exploitation probability is very low (0.03%, 11th percentile) and the issue is rated Medium by Chromium's own severity scale.
UI spoofing in Google Chrome on Android prior to 149.0.7827.53 allows remote attackers to misrepresent the Contact Picker security UI via a crafted HTML page, potentially tricking users into disclosing contact information. Chromium rates the underlying severity as Medium, and no public exploit has been identified at time of analysis. EPSS probability is very low (0.03%), and the issue is not listed in CISA KEV.
Local privilege escalation in Android 16 and Android 16-qpr2 allows a low-privileged app to deceive the user into forgetting a paired Bluetooth or companion device via a misleading UI in the ForgetDeviceDialogFragment. No public exploit identified at time of analysis, and CISA SSVC marks exploitation status as 'none' with total technical impact. The flaw is a UI spoofing weakness (CWE-451) reachable without any user interaction beyond normal dialog acknowledgement.
Local privilege escalation in Android 14 through 16-qpr2 stems from misleading UI rendering in KeyChainActivity's getApplicationLabel function, which can deceive users into granting certificate access to a malicious application. SSVC indicates no observed exploitation and the attack is not automatable, but technical impact is rated total, and no public exploit was identified at time of analysis.