Maxthon Technology Maxthon Browser prior 7.5.8.103 Fullscreen API clickjacking

Summaryinfo

A vulnerability was found in Maxthon Technology Maxthon Browser. It has been classified as problematic. This affects an unknown part of the component Fullscreen API. This manipulation causes clickjacking. This vulnerability appears as CVE-2026-119730. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Maxthon Technology Maxthon Browser. It has been declared as problematic. Affected by this vulnerability is an unknown code block of the component Fullscreen API. The manipulation with an unknown input leads to a clickjacking vulnerability. The CWE definition for the vulnerability is CWE-451. The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks. As an impact it is known to affect integrity. The summary by CVE is:

Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote attackers to misrepresent a page's origin by exploiting the lack of a persistent fullscreen notification or trusted origin indicator when the Fullscreen API is invoked. Attackers can craft a malicious web page that renders a counterfeit address bar showing a trusted domain while displaying attacker-controlled content, tricking users who perform a single tap to enter fullscreen into disclosing credentials via phishing.

It is possible to read the advisory at maxthon.com. This vulnerability is known as CVE-2026-119730 since 10/30/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1566.003 according to MITRE ATT&CK.

Upgrading to version 7.5.8.103 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Maxthon Technology

Name

• Maxthon Browser

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion