CVE-2025-15032 Details
Description
Missing about:blank indicator in custom-sized new windows in Dia before 1.9.0 on macOS could allow an attacker to spoof a trusted domain in the window title and mislead users about the current site.
A spoofing vulnerability has been identified in the Dia browser on macOS, affecting versions prior to 1.9.0. The issue arises from the absence of an 'about:blank' indicator in custom-sized new windows, which could allow an attacker to manipulate the window title to resemble a trusted domain, potentially misleading users about their current site.
Users are advised to update Dia to version 1.9.1 or newer, as these versions include the necessary fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jan 16, 2026CISA-ADP
Assessed Jan 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.diabrowser.com/security/bulletins#CVE-2025-15032 | BCNY | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1021 | Improper Restriction of Rendered UI Layers or Frames | BCNY |
Affected Products
| Product | Versions |
|---|---|
| The Browser Company Dia | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | BCNY |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 16, 2026 | New CVE Received | BCNY |