Weaknesses of type CWE-451

506 results

Representação enganosa de informação crítica na interface

A aplicação apresenta informações de segurança ou críticas de forma enganosa, confusa ou oculta na interface. Um usuário não consegue identificar claramente riscos, avisos de segurança ou status autêntico da aplicação, levando a decisões incorretas. Exemplos comuns: cadeado falso em phishing, avisos de segurança com estilo igual a anúncios legítimos, ou status de autenticação não evidente.

Example

Um site de phishing usa CSS para desenhar um ícone de cadeado genuíno na barra de endereço, ou oculta avisos críticos de certificado inválido em texto pequeno e cor opaca. Outro caso: app mobile que não deixa claro quando uma conexão está criptografada versus em texto plano.

How to mitigate

Garanta que informações críticas (status de autenticação, certificados válidos, avisos de segurança) sejam apresentadas de forma proeminente, inambígua e não-adulterável pela aplicação. Use padrões do SO para indicadores de segurança, testes de usabilidade para validar clareza de avisos, e desconfie de interfaces que ocultam ou disfarçam estado de segurança.

CVE-2025-7021MEDIUMOpenAI Operator - API Spoofing through Locking Operator on FullScreenEPSS 0.4%CVE-2026-2634CRITICALSpoofed web content presented under trusted domains using scripted navigation on Firefox iOSEPSS 0.4%CVE-2026-113241HIGHUI misrepresentation in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a cEPSS 0.4%CVE-2026-94183HIGHAddress bar spoofing risk in affected Android versions of Arc SearchEPSS 0.4%CVE-2026-0906CRITICALIncorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (UREPSS 0.4%CVE-2026-113291HIGHUI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTMLEPSS 0.4%CVE-2026-16403MEDIUMSpoofing issue in the Address Bar componentEPSS 0.4%CVE-2024-52276HIGHPDF Document Spoofing in DocuSignEPSS 0.4%CVE-2026-40416MEDIUMMicrosoft Edge (Chromium-based) for Android Spoofing VulnerabilityEPSS 0.3%CVE-2026-113149HIGHUI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTMLEPSS 0.3%CVE-2026-113138CRITICALUI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spEPSS 0.3%CVE-2026-113068HIGHUI misrepresentation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML pageEPSS 0.3%CVE-2026-113079HIGHUI misrepresentation in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proEPSS 0.3%CVE-2026-113173HIGHUI misrepresentation in UI in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to EPSS 0.3%CVE-2026-113226HIGHUI misrepresentation in Model in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elEPSS 0.3%CVE-2026-113292HIGHUI misrepresentation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a cEPSS 0.3%CVE-2026-113230HIGHUI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI EPSS 0.3%CVE-2024-23708CRITICALIn multiple functions of NotificationManagerService.java, there is a possible way to not show a toast message when a clipboard message has bEPSS 0.3%CVE-2026-94181HIGHAddress Bar Spoof Risk; Missing Fullscreen Notification via Select ElementEPSS 0.3%CVE-2024-6610MEDIUMForm validation popups could block exiting full-screen modeEPSS 0.3%