Weaknesses of type CWE-451

389 results

Representação enganosa de informação crítica na interface

A aplicação apresenta informações de segurança ou críticas de forma enganosa, confusa ou oculta na interface. Um usuário não consegue identificar claramente riscos, avisos de segurança ou status autêntico da aplicação, levando a decisões incorretas. Exemplos comuns: cadeado falso em phishing, avisos de segurança com estilo igual a anúncios legítimos, ou status de autenticação não evidente.

Example

Um site de phishing usa CSS para desenhar um ícone de cadeado genuíno na barra de endereço, ou oculta avisos críticos de certificado inválido em texto pequeno e cor opaca. Outro caso: app mobile que não deixa claro quando uma conexão está criptografada versus em texto plano.

How to mitigate

Garanta que informações críticas (status de autenticação, certificados válidos, avisos de segurança) sejam apresentadas de forma proeminente, inambígua e não-adulterável pela aplicação. Use padrões do SO para indicadores de segurança, testes de usabilidade para validar clareza de avisos, e desconfie de interfaces que ocultam ou disfarçam estado de segurança.

CVE-2026-7935MEDIUMInappropriate implementation in Speech in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafteEPSS 0.2%CVE-2026-14154MEDIUMInappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicEPSS 0.2%CVE-2026-0904MEDIUMIncorrect security UI in Digital Credentials in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform domain spoofing viEPSS 0.2%CVE-2026-18003MEDIUMInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofiEPSS 0.2%CVE-2026-63020LOWBIG-IP Configuration utility vulnerabilityEPSS 0.2%CVE-2026-5905MEDIUMIncorrect security UI in Permissions in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to perform domain spoofingEPSS 0.2%CVE-2026-87653MEDIUMUI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via EPSS 0.2%CVE-2026-3937MEDIUMIncorrect security UI in Downloads in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via aEPSS 0.2%CVE-2026-8561MEDIUMIncorrect security UI in Fullscreen in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to perform UI spoofing via a crafted EPSS 0.2%CVE-2026-2919MEDIUMAttacker-controlled content shown under spoofed domains in Focus for iOS via stalled navigation and iframe redirectEPSS 0.2%CVE-2025-13102MEDIUMInappropriate implementation in WebApp Installs in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI sEPSS 0.2%CVE-2026-87501MEDIUMUI misrepresentation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML EPSS 0.2%CVE-2026-11285MEDIUMInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofiEPSS 0.2%CVE-2025-46394LOWIn tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.EPSS 0.2%CVE-2026-17983MEDIUMInappropriate implementation in Global Media Controls in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofiEPSS 0.2%CVE-2025-14020MEDIUMLINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in the in-app browser where the full-screen security ToEPSS 0.2%CVE-2025-12729MEDIUMInappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user tEPSS 0.2%CVE-2026-11925LOWTanium addressed a User Interface (UI) Misrepresentation of Critical Information vulnerability in Tanium Server.EPSS 0.2%CVE-2026-3942MEDIUMIncorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a craEPSS 0.2%CVE-2026-3927MEDIUMIncorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a craEPSS 0.2%