CWE-451— User Interface Misrepresentation of Critical Information
The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.— MITRE CWE catalog
515 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-451page 1 of 11
- CVE-2024-43461CRITICALCVSS 8.8EG 9.0⚠ KEV2024-09-10
Windows MSHTML Platform Spoofing Vulnerability
- CVE-2024-38112CRITICALCVSS 7.5EG 9.0⚠ KEV2024-07-09
Windows MSHTML Platform Spoofing Vulnerability
- CVE-2026-2634CRITICALCVSS 9.8EG 9.82026-02-24
Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controlled pages to be presented under spoofed domains. This vulnerability was fixed in…
- CVE-2026-0907CRITICALCVSS 9.8EG 9.82026-01-20
Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-0906CRITICALCVSS 9.8EG 9.82026-01-20
Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)
- CVE-2025-8043CRITICALCVSS 9.8EG 9.82025-07-22
Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141.
- CVE-2024-23708CRITICALCVSS 7.8EG 9.82024-05-07
In multiple functions of NotificationManagerService.java, there is a possible way to not show a toast message when a clipboard message has been accessed. This could lead to local escalation of privilege with no additional execution privile…
- CVE-2026-0904CRITICALCVSS 5.4EG 9.82026-01-20
Incorrect security UI in Digital Credentials in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-113169CRITICALCVSS 9.6EG 9.62026-10-20
UI misrepresentation in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to spoof UI elements via a co-installed app. (Chromium security severity: Low)
- CVE-2026-113138CRITICALCVSS 9.6EG 9.62026-10-20
UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-113171CRITICALCVSS 9.6EG 9.62026-10-20
UI misrepresentation in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to spoof UI elements via a co-installed app. (Chromium security severity: Medium)
- CVE-2026-118027CRITICALCVSS 9.1EG 9.12026-10-27
Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44.
- CVE-2026-114171HIGHCVSS 8.8EG 8.82026-11-10
User interface (ui) misrepresentation of critical information in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- CVE-2026-118018HIGHCVSS 8.8EG 8.82026-10-27
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 159.
- CVE-2026-118011HIGHCVSS 8.8EG 8.82026-10-27
Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
- CVE-2026-113088HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-113067HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)
- CVE-2026-113046HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-113182HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-112994HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-113173HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in UI in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-113156HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-113292HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-113145HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-113080HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted Chrome extension. (Chromium security severity: Low)
- CVE-2026-113025HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-113226HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Model in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-113241HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-113291HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-113323HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-113312HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Autofill in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-113096HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-113170HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-113090HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Interstitials in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-113230HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-113204HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in TrustedWebActivities in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-113206HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-113149HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-113278HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)
- CVE-2026-113009HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-113307HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)
- CVE-2026-113060HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed an adjacent attacker leveraging social engineering to spoof UI elements via a malicious peripheral. (Chromium security severity: Medium)
- CVE-2026-113191HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Internals in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-113079HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Low)
- CVE-2026-113320HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-113068HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-113055HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-113298HIGHCVSS 8.8EG 8.82026-10-20
UI misrepresentation in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: …
- CVE-2026-11175HIGHCVSS 8.8EG 8.82026-06-04
Incorrect security UI in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-11172HIGHCVSS 8.8EG 8.82026-06-04
Incorrect security UI in Contact Picker in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Map vulnerabilities like CWE-451 to your infrastructure
EchelonGraph correlates every CVE — across CWE-451 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →