Address bar spoofing in Maxthon Browser for Android via Fullscreen API
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-451.
Summary
Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing flaw in its Fullscreen API handling. A remote attacker can craft a web page that displays a fake address bar showing a trusted domain while the page content is attacker-controlled. A user who taps once to enter fullscreen may be tricked into entering credentials into a phishing page, because the browser shows no persistent fullscreen notification or trusted origin indicator. The flaw is classified as CWE-451, UI misrepresentation of critical information.
Written with Claude Haiku 5.5 from the sources below · 2026-10-31
Description from the CNA
Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote attackers to misrepresent a page's origin by exploiting the lack of a persistent fullscreen notification or trusted origin indicator when the Fullscreen API is invoked. Attackers can craft a malicious web page that renders a counterfeit address bar showing a trusted domain while displaying attacker-controlled content, tricking users who perform a single tap to enter fullscreen into disclosing credentials via phishing.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Maxthon Technology Limited | Maxthon Browser for Android | before 7.5.8.103 | 7.5.8.103 | Patch available | CNA |
- Maxthon Browser for Android VendorMaxthon Technology Limited Affected before 7.5.8.103 Fixed in 7.5.8.103 Patch available CNA
Remediation
Update Maxthon Browser for Android to version 7.5.8.103 or later, which fixes this flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-10-31
- Fix · CNA Maxthon Browser for Android (Maxthon Technology Limited) Fixed in 7.5.8.103
Timeline
- 2026-10-30 Threatist record created from CVE-2026-119730
- 2026-10-30 Alias added: GHSA-59rh-729h-3ffx
- 2026-11-05 CISA SSVC decision points changed
References
Patch 1
Sources
- CVE-2026-119730 · CVE Program
- CVE-2026-119730 · NVD
- FIRST EPSS
- GHSA-59rh-729h-3ffx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences