Improper Restriction of Rendered UI Layers or Frames

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

CVEs (400)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-0386 1Google 1Android Jun 17, 2026 Mar 10, 2021 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 In onCreate of UsbConfirmActivity, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of privilege with User execution privileges needed. User interaction is neede...Show more In onCreate of UsbConfirmActivity, there is a possible tapjacking vector due to an insecure default value. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-173421110Show less
CVE-2021-0391 1Google 1Android Jun 17, 2026 Mar 10, 2021 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 In onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account, without permissions, due to a tapjacking/overlay attack. This could lead to local escalation of privilege...Show more In onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account, without permissions, due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-172841550Show less
CVE-2021-23955 1Mozilla 1Firefox Jun 17, 2026 Feb 26, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The browser could have been confused into transferring a pointer lock state into another tab, which could have lead to clickjacking attacks. This vulnerability affects Firefox < 85.
CVE-2021-23976 1Mozilla 1Firefox Jun 17, 2026 Feb 26, 2021 N/A· v4 8.1 HIGH· v3 5.8 MEDIUM· v2 When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscree...Show more When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. Note: This issue is a different issue from CVE-2020-26954 and only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 86.Show less
CVE-2021-27375 1Containous 1Traefik Jun 17, 2026 Feb 18, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Traefik before 2.4.5 allows the loading of IFRAME elements from other domains.
CVE-2021-0333 1Google 1Android Jun 17, 2026 Feb 10, 2021 N/A· v4 7.3 HIGH· v3 6.9 MEDIUM· v2 In onCreate of BluetoothPermissionActivity.java, there is a possible permissions bypass due to a tapjacking overlay that obscures the phonebook permissions dialog when a Bluetooth device is connecting. This could lead to...Show more In onCreate of BluetoothPermissionActivity.java, there is a possible permissions bypass due to a tapjacking overlay that obscures the phonebook permissions dialog when a Bluetooth device is connecting. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-168504491Show less
CVE-2021-0331 1Google 1Android Jun 17, 2026 Feb 10, 2021 N/A· v4 7.3 HIGH· v3 6.9 MEDIUM· v2 In onCreate of NotificationAccessConfirmationActivity.java, there is a possible overlay attack due to an insecure default value. This could lead to local escalation of privilege and notification access with User executio...Show more In onCreate of NotificationAccessConfirmationActivity.java, there is a possible overlay attack due to an insecure default value. This could lead to local escalation of privilege and notification access with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-170731783Show less
CVE-2021-0314 1Google 1Android Jun 17, 2026 Feb 10, 2021 N/A· v4 7.3 HIGH· v3 6.9 MEDIUM· v2 In onCreate of UninstallerActivity, there is a possible way to uninstall an all without informed user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privi...Show more In onCreate of UninstallerActivity, there is a possible way to uninstall an all without informed user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-171221302Show less
CVE-2021-0305 1Google 1Android Jun 17, 2026 Feb 10, 2021 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilege and permissions with no additional execution privileges needed. User interacti...Show more In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilege and permissions with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10Android ID: A-154015447Show less
CVE-2021-0302 1Google 1Android Jun 17, 2026 Feb 10, 2021 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilege and permissions with no additional execution privileges needed. User interacti...Show more In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilege and permissions with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10Android ID: A-155287782Show less
CVE-2021-21444 1Sap 1Businessobjects Business Intelligence Jun 17, 2026 Feb 9, 2021 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which may not be predictably treated by all user agents. This could, as a result, nulli...Show more SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which may not be predictably treated by all user agents. This could, as a result, nullify the added X-Frame-Options header leading to Clickjacking attack.Show less
CVE-2021-21139 2Google Microsoft 2Chrome Edge Chromium Jun 17, 2026 Feb 9, 2021 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Inappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVE-2021-21132 2Google Microsoft 2Chrome Edge Chromium Jun 17, 2026 Feb 9, 2021 N/A· v4 9.6 CRITICAL· v3 6.8 MEDIUM· v2 Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted Chrome Extension.
CVE-2020-4547 1Ibm 11Collaborative Lifecycle Management Engineering InsightsEngineering Lifecycle Management+8 more Jun 17, 2026 Jan 27, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 IBM Jazz Foundation products could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack t...Show more IBM Jazz Foundation products could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 183315.Show less
CVE-2021-0315 1Google 1Android Jun 17, 2026 Jan 11, 2021 N/A· v4 7.3 HIGH· v3 4.4 MEDIUM· v2 In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to convince the user to grant an app access to an account due to a tapjacking/overlay attack. This could lead to local escalation of privile...Show more In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to convince the user to grant an app access to an account due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.1, Android-9, Android-10, Android-11, Android-8.0; Android ID: A-169763814.Show less
CVE-2020-27059 1Google 1Android Jun 17, 2026 Jan 11, 2021 N/A· v4 7.8 HIGH· v3 4.4 MEDIUM· v2 In onAuthenticated of AuthenticationClient.java, there is a possible tapjacking attack when requesting the user's fingerprint due to an overlaid window. This could lead to local escalation of privilege with no additional...Show more In onAuthenticated of AuthenticationClient.java, there is a possible tapjacking attack when requesting the user's fingerprint due to an overlaid window. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.0, Android-8.1, Android-9, Android-10, 11; Android ID: A-159249069.Show less
CVE-2021-21111 3Debian FedoraprojectGoogle 3Chrome Debian LinuxFedora Jun 17, 2026 Jan 8, 2021 N/A· v4 9.6 CRITICAL· v3 6.8 MEDIUM· v2 Insufficient policy enforcement in WebUI in Google Chrome prior to 87.0.4280.141 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Exte...Show more Insufficient policy enforcement in WebUI in Google Chrome prior to 87.0.4280.141 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.Show less
CVE-2020-5020 1Ibm 1Spectrum Protect Plus Jun 17, 2026 Jan 8, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulner...Show more IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 193656.Show less
CVE-2020-16033 1Google 1Chrome Jun 17, 2026 Jan 8, 2021 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof security UI via a crafted HTML page.
CVE-2020-16032 1Google 1Chrome Jun 17, 2026 Jan 8, 2021 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 Insufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

Previous 1...141516...20 Next