Falhas do tipo CWE-451

506 resultados

Má representação de informações críticas na interface

A aplicação exibe informações de segurança críticas de forma enganosa, confusa ou incompleta na interface do usuário. Isso leva o usuário a tomar decisões perigosas — como confiar em dados falsos, ignorar avisos reais ou autorizar operações maliciosas — porque a UI não comunica o risco com clareza.

Exemplo

Um navegador que mostra um aviso de certificado SSL inválido em letras minúsculas cinzentas no rodapé da página, enquanto a barra de endereço verde continua exibindo cadeado. Ou um aplicativo bancário que não deixa evidente se uma transação é reversível ou definitiva, levando o usuário a confirmar uma transferência irreversível sem entender as consequências.

Como mitigar

Destaque informações críticas (avisos, confirmações, mudanças de estado) com contraste visual alto, ícones claros e mensagens em linguagem simples. Implemente confirmações explícitas para operações irreversíveis e testes de usabilidade com usuários reais para validar se entendem os riscos antes de agir.

CVE-2025-7021MEDIUMOpenAI Operator - API Spoofing through Locking Operator on FullScreenEPSS 0.4%CVE-2026-2634CRITICALSpoofed web content presented under trusted domains using scripted navigation on Firefox iOSEPSS 0.4%CVE-2026-113241HIGHUI misrepresentation in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a cEPSS 0.4%CVE-2026-94183HIGHAddress bar spoofing risk in affected Android versions of Arc SearchEPSS 0.4%CVE-2026-0906CRITICALIncorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (UREPSS 0.4%CVE-2026-113291HIGHUI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTMLEPSS 0.4%CVE-2026-16403MEDIUMSpoofing issue in the Address Bar componentEPSS 0.4%CVE-2024-52276HIGHPDF Document Spoofing in DocuSignEPSS 0.4%CVE-2026-40416MEDIUMMicrosoft Edge (Chromium-based) for Android Spoofing VulnerabilityEPSS 0.3%CVE-2026-113149HIGHUI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTMLEPSS 0.3%CVE-2026-113138CRITICALUI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spEPSS 0.3%CVE-2026-113068HIGHUI misrepresentation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML pageEPSS 0.3%CVE-2026-113079HIGHUI misrepresentation in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proEPSS 0.3%CVE-2026-113173HIGHUI misrepresentation in UI in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to EPSS 0.3%CVE-2026-113226HIGHUI misrepresentation in Model in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elEPSS 0.3%CVE-2026-113292HIGHUI misrepresentation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a cEPSS 0.3%CVE-2026-113230HIGHUI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI EPSS 0.3%CVE-2024-23708CRITICALIn multiple functions of NotificationManagerService.java, there is a possible way to not show a toast message when a clipboard message has bEPSS 0.3%CVE-2026-94181HIGHAddress Bar Spoof Risk; Missing Fullscreen Notification via Select ElementEPSS 0.3%CVE-2024-6610MEDIUMForm validation popups could block exiting full-screen modeEPSS 0.3%