CVE-2026-119730 Details
Description
Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote attackers to misrepresent a page's origin by exploiting the lack of a persistent fullscreen notification or trusted origin indicator when the Fullscreen API is invoked. Attackers can craft a malicious web page that renders a counterfeit address bar showing a trusted domain while displaying attacker-controlled content, tricking users who perform a single tap to enter fullscreen into disclosing credentials via phishing.
A spoofing vulnerability in the address bar has been identified in Maxthon Browser for Android versions prior to 7.5.8.103. This vulnerability allows remote attackers to misrepresent a webpage's origin by taking advantage of the absence of a persistent fullscreen notification or a trusted origin indicator when the Fullscreen API is used. Attackers can create a malicious webpage that displays a counterfeit address bar with a trusted domain while showing content controlled by the attacker. This can deceive users into disclosing credentials through phishing, especially when they tap to enter fullscreen.
Users are advised to update Maxthon Browser for Android to version 7.5.8.103 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.maxthon.com/history | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/maxthon-browser-for-android-fullscreen-address-bar-spoofing | [email protected] | AdvisoryPartial Content |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-451 | User Interface (UI) Misrepresentation of Critical Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Maxthon Browser | < 7.5.8.103 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |