Skip to content
Noroxi

CWE-1021 · 411 records

Improper Restriction of Rendered UI Layers or Frames

CVEs in this class

411 records

  • CVE-2021-21132
    46Plan

    Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox e

    CriticalCVSS 9.6No exploitEPSS 25%

    google · chromeFeb 9, 2021

  • CVE-2021-43048
    39Monitor

    TIBCO PartnerExpress Click-Jacking vulnerability

    CriticalCVSS 9.8No exploitEPSS 1%

    tibco · partnerexpressNov 16, 2021

  • CVE-2021-23274
    39Monitor

    TIBCO API Exchange Gateway Clickjack Vulnerability

    CriticalCVSS 9.8No exploitEPSS 1%

    tibco · api exchange gatewayMar 23, 2021

  • CVE-2016-2496
    39Monitor

    The Framework UI permission-dialog implementation in Android 6.x before 2016-06-01 allows attackers to conduct tapjacking attacks and access

    CriticalCVSS 9.8No exploitEPSS 0%

    google · androidJun 12, 2016

  • CVE-2023-41897
    38Monitor

    Lack of XFO header allows clickjacking in Home Assistant Core

    CriticalCVSS 9.6No exploitEPSS 1%

    home-assistant · home-assistantOct 19, 2023

  • CVE-2021-21111
    38Monitor

    Insufficient policy enforcement in WebUI in Google Chrome prior to 87.0.4280.141 allowed an attacker who convinced a user to install a malic

    CriticalCVSS 9.6No exploitEPSS 1%

    google · chromeJan 8, 2021

  • CVE-2026-84388
    38Monitor

    A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions may allow attack

    CriticalCVSS 9.6No exploitEPSS 0%

    fortinet · fortipam chrome extensionSep 22, 2026

  • CVE-2024-10004
    36Monitor

    Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in t

    CriticalCVSS 9.1No exploitEPSS 0%

    mozilla · firefoxOct 15, 2024

  • CVE-2022-3167
    35Monitor

    Improper Restriction of Rendered UI Layers or Frames in ikus060/rdiffweb

    HighCVSS 8.8No exploitEPSS 1%

    ikus-soft · rdiffwebSep 8, 2022

  • CVE-2018-18496
    35Monitor

    When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking

    HighCVSS 8.8No exploitEPSS 1%

    mozilla · firefoxFeb 28, 2019

  • CVE-2021-3734
    35Monitor

    Improper Restriction of Rendered UI Layers or Frames in yourls/yourls

    HighCVSS 8.8No exploitEPSS 0%

    yourls · yourlsAug 26, 2021

  • CVE-2026-113063
    35Monitor

    Clickjacking in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI eleme

    HighCVSS 8.8No exploitEPSS 0%

    google · chromeOct 20, 2026

  • CVE-2026-102236
    34Monitor

    Visual Studio Code Security Feature Bypass Vulnerability

    HighCVSS 8.6No exploitEPSS 0%

    microsoft · visual studio code3 days ago

  • CVE-2026-0007
    34Monitor

    In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack.

    HighCVSS 8.6No exploitEPSS 0%

    google · androidMar 2, 2026

  • CVE-2019-16371
    32Monitor

    LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a victim's account on a pr

    HighCVSS 8.2No exploitEPSS 1%

    logmein · lastpassSep 16, 2019

  • CVE-2020-7705
    32Monitor

    This affects the package MintegralAdSDK from 0.0.0.

    HighCVSS 8.1No exploitEPSS 1%

    mintegral · mintegraladsdkAug 24, 2020

  • CVE-2021-23976
    32Monitor

    When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed de

    HighCVSS 8.1No exploitEPSS 1%

    mozilla · firefoxFeb 25, 2021

  • CVE-2021-44683
    32Monitor

    The DuckDuckGo browser 7.64.4 on iOS allows Address Bar Spoofing due to mishandling of the JavaScript window.open function (used to open a s

    HighCVSS 8.2No exploitEPSS 0%

    duckduckgo · duckduckgoMar 25, 2022

  • CVE-2020-13119
    32Monitor

    ismartgate PRO 1.5.9 is vulnerable to clickjacking.

    HighCVSS 8.1No exploitEPSS 0%

    gogogate · ismartgate pro firmwareSep 24, 2020

  • CVE-2026-58595
    32Monitor

    Microsoft Bing App for IOS Spoofing Vulnerability

    HighCVSS 8.1No exploitEPSS 0%

    microsoft · bing searchJul 14, 2026

  • CVE-2021-0433
    32Monitor

    In onCreate of DeviceChooserActivity.java, there is a possible way to bypass user consent when pairing a Bluetooth device due to a tapjackin

    HighCVSS 8.0Proof of conceptEPSS 0%

    google · androidApr 13, 2021

  • CVE-2024-11700
    32Monitor

    Malicious websites may have been able to perform user intent confirmation through tapjacking.

    HighCVSS 8.1No exploitEPSS 0%

    mozilla · firefoxNov 26, 2024

  • CVE-2024-33377
    32Monitor

    LB-LINK BL-W1210M v2.0 was discovered to contain a clickjacking vulnerability via the Administrator login page.

    HighCVSS 8.1No exploitEPSS 0%

    lb-link · bl-w1210m firmwareJun 14, 2024

  • CVE-2026-74978
    32Monitor

    Clickjacking issue in the Widget component

    HighCVSS 8.1No exploitEPSS 0%

    mozilla · firefoxAug 18, 2026

  • CVE-2026-22918
    32Monitor

    An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously cra

    HighCVSS 8.2No exploitEPSS 0%

    sick · tdc-x401gl firmwareJan 15, 2026

All vulnerability classes