CVE-2026-119730— Maxthon Browser for Android < 7.5.8.103 Fullscreen Address Bar Spoofing
Quick assessment
Affected
Maxthon Technology Limited Maxthon Browser for Android
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Maxthon Android 浏览器在 7.5.8.103 版本之前存在地址栏欺骗漏洞。当调用全屏 API 时，由于缺少持久的全屏通知或可信来源标识，远程攻击者可借此伪造页面的真实来源。攻击者可以构造恶意网页，渲染一个显示为可信域名的伪造地址栏，同时展示由攻击者控制的内容；用户只需单击一次即可进入全屏模式，从而被诱导在钓鱼页面中输入凭据。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Maxthon Technology Limited | Maxthon Browser for Android | < 7.5.8.103 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-119730
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Maxthon Browser for Android < 7.5.8.103 Fullscreen Address Bar Spoofing
Source: CVE Program / CVE List V5
Vulnerability Description
Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote attackers to misrepresent a page's origin by exploiting the lack of a persistent fullscreen notification or trusted origin indicator when the Fullscreen API is invoked. Attackers can craft a malicious web page that renders a counterfeit address bar showing a trusted domain while displaying attacker-controlled content, tricking users who perform a single tap to enter fullscreen into disclosing credentials via phishing.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键信息的UI错误表达
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Maxthon Technology Limited | Maxthon Browser for Android | 0 ~ 7.5.8.103 | - |
|
II. Public POCs for CVE-2026-119730
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-119730
请登录查看更多情报信息。