CVE-2026-119730 in Maxthon Browser
Summary
by MITRE • 10/30/2026
Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote attackers to misrepresent a page's origin by exploiting the lack of a persistent fullscreen notification or trusted origin indicator when the Fullscreen API is invoked. Attackers can craft a malicious web page that renders a counterfeit address bar showing a trusted domain while displaying attacker-controlled content, tricking users who perform a single tap to enter fullscreen into disclosing credentials via phishing.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Maxthon Browser for Android prior to version 7.5.8.103 represents a critical security flaw rooted in the improper handling of browser user interface elements during full-screen mode transitions. This issue specifically targets the address bar and its associated origin indicators, which serve as primary trust signals for end-users verifying the legitimacy of web content. When an attacker crafts a malicious webpage that invokes the Fullscreen API, the browser fails to maintain persistent visual cues regarding the true domain or URL being accessed. Instead of displaying the actual source of the content, the interface allows for address bar spoofing, where the displayed text can be manipulated to reflect a trusted and legitimate domain while simultaneously rendering attacker-controlled content in the main viewport. This discrepancy creates a deceptive environment that undermines the fundamental security model of web browsers, which relies on accurate visual feedback to prevent social engineering attacks.
From a technical perspective, this flaw exploits the gap between the browser's internal state management and its UI presentation layer during fullscreen events. Modern browsers typically employ mechanisms such as persistent notifications or distinct origin indicators when entering full-screen mode to ensure users remain aware of their location within the web ecosystem. In Maxthon Browser versions affected by this vulnerability, these safeguards are either absent or insufficiently enforced. Consequently, a malicious script can hijack the visual representation of the address bar, making it appear identical to that of a trusted entity such as a banking portal or email service provider. This technique is particularly effective because users often rely on the presence of familiar branding and URL structures in the browser chrome rather than inspecting deeper security details like certificate validity or exact domain spelling when interacting with content displayed at full screen.
The operational impact of this vulnerability is severe, primarily facilitating sophisticated phishing campaigns that bypass traditional user skepticism. By presenting a counterfeit address bar alongside malicious login forms or credential harvesting interfaces, attackers can trick users into believing they are on a legitimate site. The requirement for the victim to perform only a single tap to enter fullscreen mode lowers the barrier for exploitation, making it easy for social engineers to lure targets into this trap. Once inside the spoofed full-screen environment, victims may unknowingly submit sensitive information such as usernames, passwords, or two-factor authentication codes directly to the attacker's infrastructure. This not only compromises individual account security but can also lead to broader organizational breaches if corporate credentials are targeted, highlighting the critical importance of accurate UI integrity in mobile browsing contexts.
This vulnerability aligns with CWE-201, which describes insertion of sensitive information into an external component where it may be observed by unauthorized actors, although more specifically it relates to CWE-798, use of hardcoded credentials or trust relationships, and CWE-443, description list without dl/dt/dd tags in the context of UI deception. In terms of offensive security frameworks, this technique maps directly to MITRE ATT&CK tactic T1566.002, known as Spearphishing Link, specifically leveraging URL spoofing or domain impersonation techniques. The attack vector is classified under Remote Code Execution via Browser Exploitation, relying on user interaction rather than pure software exploitation. To mitigate this risk, users must upgrade to Maxthon Browser version 7.5.8.103 or later, where the developers have implemented proper enforcement of persistent fullscreen notifications and trusted origin indicators. Additionally, security awareness training should emphasize verifying URL details even when in full-screen mode, as visual spoofing remains a potent threat vector against mobile users who may be less accustomed to scrutinizing browser chrome compared to desktop users.