CVE WatchAug 10, 2026

CVE-2024-43461

Microsoft Windows MSHTML Platform Spoofing Vulnerability

CVSS

8.8

High

EPSS

54.5%

p99

KEV

YES

Sep 16, 2024

Exploit Today

0-100

Published: Sep 10, 2024 · Last modified: Aug 10, 2026 · CWE-451

EPSS · 30d

54.5%EPSS · 30 days54.5%

2026-09-162026-10-14

KEV catalog record

Product

Microsoft / Windows

Vulnerability

Microsoft Windows MSHTML Platform Spoofing Vulnerability

Added to KEV

Sep 16, 2024

Remediate by

Oct 7, 2024

Known ransomware use

Summary description

Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43461 ; https://nvd.nist.gov/vuln/detail/CVE-2024-43461

Technical description

Windows MSHTML Platform Spoofing Vulnerability

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-969518.8 HIG

73.8%

KEV—72Microsoft Windows Command Injection Vulnerability12h CVE-2026-1063805.4 MED

10.6%

——3UI misrepresentation in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)8d CVE-2026-1063685.4 MED

6.6%

——2UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)12h CVE-2026-106338—

9.0%

——3UI misrepresentation in PictureInPicture in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)8d CVE-2026-1063375.4 MED

9.0%

——3UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)8d CVE-2026-1063175.4 MED

9.0%

——3UI misrepresentation in FullScreen in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)8d