Weaknesses of type CWE-451

506 results

Representação enganosa de informação crítica na interface

A aplicação apresenta informações de segurança ou críticas de forma enganosa, confusa ou oculta na interface. Um usuário não consegue identificar claramente riscos, avisos de segurança ou status autêntico da aplicação, levando a decisões incorretas. Exemplos comuns: cadeado falso em phishing, avisos de segurança com estilo igual a anúncios legítimos, ou status de autenticação não evidente.

Example

Um site de phishing usa CSS para desenhar um ícone de cadeado genuíno na barra de endereço, ou oculta avisos críticos de certificado inválido em texto pequeno e cor opaca. Outro caso: app mobile que não deixa claro quando uma conexão está criptografada versus em texto plano.

How to mitigate

Garanta que informações críticas (status de autenticação, certificados válidos, avisos de segurança) sejam apresentadas de forma proeminente, inambígua e não-adulterável pela aplicação. Use padrões do SO para indicadores de segurança, testes de usabilidade para validar clareza de avisos, e desconfie de interfaces que ocultam ou disfarçam estado de segurança.

CVE-2026-113204HIGHUI misrepresentation in TrustedWebActivities in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging sociEPSS 0.3%CVE-2025-62224MEDIUMMicrosoft Edge (Chromium-based) for Android Spoofing VulnerabilityEPSS 0.3%CVE-2026-45150MEDIUMZen Browser - Missing Fullscreen Security Notification Allows Origin SpoofingEPSS 0.3%CVE-2026-33119MEDIUMMicrosoft Edge (Chromium-based) for Android Spoofing VulnerabilityEPSS 0.3%CVE-2026-118011HIGHFrame poisoning in the CSS Parsing and Computation componentEPSS 0.3%CVE-2026-113170HIGHUI misrepresentation in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a EPSS 0.3%CVE-2026-113046HIGHUI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML EPSS 0.3%CVE-2026-113090HIGHUI misrepresentation in Interstitials in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoEPSS 0.3%CVE-2025-9867MEDIUMInappropriate implementation in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofinEPSS 0.3%CVE-2026-3861HIGHLINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly EPSS 0.3%CVE-2025-32371MEDIUMUnexpected external content may be displayed in DNN ImageHandlerEPSS 0.3%CVE-2026-109434MEDIUMSleipnir Browser < 3.9.0 Fullscreen Address Bar SpoofingEPSS 0.3%CVE-2026-8964HIGHSpoofing issue in the Popup Blocker componentEPSS 0.3%CVE-2025-3074MEDIUMInappropriate implementation in Downloads in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform UI spoofing via a craEPSS 0.3%CVE-2026-11925LOWTanium addressed a User Interface (UI) Misrepresentation of Critical Information vulnerability in Tanium Server.EPSS 0.3%CVE-2025-43712LOWJHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering in the JHipster portal and logginEPSS 0.3%CVE-2025-4086MEDIUMSpecially crafted filename could be used to obscure download typeEPSS 0.3%CVE-2025-3073MEDIUMInappropriate implementation in Autofill in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage inEPSS 0.3%CVE-2025-3072MEDIUMInappropriate implementation in Custom Tabs in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engageEPSS 0.3%CVE-2026-117960MEDIUMSpoofing issue in the DOM: Core & HTML componentEPSS 0.3%