Live › vulnerability › CVE-2026-119730
Maxthon Browser for Android before 7.5.8.103 does not show a persistent fullscreen notice or trusted-origin indicator when a page enters fullscreen. A malicious page can draw a fake address bar showing a trusted domain, so a user who taps once to go fullscreen may type credentials into an attacker's page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:25 UTC. All times on this page are UTC.
Anyone using Maxthon Browser for Android before 7.5.8.103 who visits a malicious or compromised web page and taps to enter fullscreen. The flaw is in the browser's UI, so the server side of a website is not the issue; sites you already trust are not the risk. Desktop browsers and other Android browsers are not named in the sources.
No product ranges from the sources yet.
7.5.8.103 or later is the fixed build named in the advisory.7.5.8.103Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote attackers to misrepresent a page's origin by exploiting the lack of a persistent fullscreen notification or trusted origin indicator when the Fullscreen API is invoked. Attackers can craft a malicious web page that renders a counterfeit address bar showing a trusted domain while displaying attacker-controlled content, tricking users who perform a single tap to enter fullscreen into disclosing credentials via phishing.
This page as .md · .json · in your agent: get_signal("CVE-2026-119730")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.