{"id":"CVE-2026-119730","kind":"vulnerability","aliases":["CVE-2026-119730"],"related":[],"title":"Maxthon Android browser: fullscreen mode lets pages fake the address bar","description":"Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote attackers to misrepresent a page's origin by exploiting the lack of a persistent fullscreen notification or trusted origin indicator when the Fullscreen API is invoked. Attackers can craft a malicious web page that renders a counterfeit address bar showing a trusted domain while displaying attacker-controlled content, tricking users who perform a single tap to enter fullscreen into disclosing credentials via phishing.","summary":"Maxthon Browser for Android before 7.5.8.103 does not show a persistent fullscreen notice or trusted-origin indicator when a page enters fullscreen. A malicious page can draw a fake address bar showing a trusted domain, so a user who taps once to go fullscreen may type credentials into an attacker's page.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","maxthon","mobile-browser","other"],"not_affected_if":["maxthon-7.5.8.103-or-later","not-using-maxthon-android"],"how_to_check":"- Open Maxthon on Android and check the version under the app's About or settings screen; `7.5.8.103` or later is the fixed build named in the advisory.","fix":"- Maxthon Browser for Android: `7.5.8.103`","status":"open","published_at":"2026-10-30T20:17:08+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","triaged_at":"2026-10-30T20:26:51+00:00","updated_at":"2026-10-30T20:26:51+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-30T20:26:51Z","model":"claude-haiku-5-5","output":{"fix":"- Maxthon Browser for Android: `7.5.8.103`","reach":"internet","title":"Maxthon Android browser: fullscreen mode lets pages fake the address bar","impact":"medium","summary":"Maxthon Browser for Android before 7.5.8.103 does not show a persistent fullscreen notice or trusted-origin indicator when a page enters fullscreen. A malicious page can draw a fake address bar showing a trusted domain, so a user who taps once to go fullscreen may type credentials into an attacker's page.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","maxthon","mobile-browser"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"User enters credentials into a phishing page disguised as a trusted site","analyst_note":"","how_to_check":"- Open Maxthon on Android and check the version under the app's About or settings screen; `7.5.8.103` or later is the fixed build named in the advisory.","plain_action":"Update Maxthon Browser on your Android phone to version 7.5.8.103 or later.","needs_analyst":false,"not_affected_if":["maxthon-7.5.8.103-or-later","not-using-maxthon-android"],"who_is_affected":"Anyone using Maxthon Browser for Android before 7.5.8.103 who visits a malicious or compromised web page and taps to enter fullscreen. The flaw is in the browser's UI, so the server side of a website is not the issue; sites you already trust are not the risk. Desktop browsers and other Android browsers are not named in the sources.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000716,"input_tokens":4206,"output_tokens":590,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119730':14A,17A '-2026':13A,16A '7.5.8.103':28B,81C 'address':10A,53B,84C,128C 'allow':89C 'android':2A,18B,26B,79C 'api':114C 'attack':73B,91C,117C,137C 'attacker-control':136C 'bar':11A,54B,85C,129C 'browser':3A,22B,24B,77C 'contain':82C 'content':139C 'control':138C 'counterfeit':127C 'craft':119C 'credenti':70B,152C 'cve':12A,15A 'disclos':151C 'display':135C 'domain':58B,133C 'draw':50B 'enter':44B,148C 'exploit':99C 'fake':8A,52B 'fullscreen':4A,34B,45B,67B,105C,113C,149C 'go':66B 'indic':40B,110C 'invok':116C 'lack':101C 'let':6A 'malici':47B,121C 'maxthon':1A,19B,23B,76C 'may':68B 'misrepres':93C 'mobil':21B 'mobile-brows':20B 'mode':5A 'notic':35B 'notif':106C 'origin':39B,97C,109C 'page':7A,43B,48B,75B,95C,123C 'perform':143C 'persist':33B,104C 'phish':154C 'remot':90C 'render':125C 'show':31B,55B,130C 'singl':145C 'spoof':86C 'tap':63B,146C 'trick':140C 'trust':38B,57B,108C,132C 'trusted-origin':37B 'type':69B 'user':61B,141C 'via':153C 'vulner':87C 'web':122C","nicknames":[],"mitigations":[],"who_affected":"Anyone using Maxthon Browser for Android before 7.5.8.103 who visits a malicious or compromised web page and taps to enter fullscreen. The flaw is in the browser's UI, so the server side of a website is not the issue; sites you already trust are not the risk. Desktop browsers and other Android browsers are not named in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Maxthon Browser on your Android phone to version 7.5.8.103 or later.","first_public_at":"2026-10-30T20:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119730","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119730","severity":null,"published_at":"2026-10-30T20:17:08+00:00","modified_at":"2026-10-30T20:17:08+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","fetched_at":"2026-10-30T20:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}