CVE WatchAug 10, 2026

CVE-2024-43461

Microsoft Windows MSHTML Platform Spoofing Vulnerability

CVSS

8.8

High

EPSS

54.5%

p99

KEV

YES

Sep 16, 2024

Exploit Today

0-100

Published: Sep 10, 2024 · Last modified: Aug 10, 2026 · CWE-451

EPSS · 30d

51.9%EPSS · 30 days54.5%

2026-08-022026-08-30

KEV catalog record

Product

Microsoft / Windows

Vulnerability

Microsoft Windows MSHTML Platform Spoofing Vulnerability

Added to KEV

Sep 16, 2024

Remediate by

Oct 7, 2024

Known ransomware use

Summary description

Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43461 ; https://nvd.nist.gov/vuln/detail/CVE-2024-43461

Technical description

Windows MSHTML Platform Spoofing Vulnerability

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-792844.3 MED

13.7%

——4UI misrepresentation in Core in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)4d CVE-2026-792835.4 MED

9.6%

——3UI misrepresentation in Geometry in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)3d CVE-2026-792505.4 MED

16.2%

——5UI misrepresentation in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)3d CVE-2026-792334.3 MED

8.7%

——3UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)3d CVE-2026-792045.4 MED

16.1%

——5UI misrepresentation in Input in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)3d CVE-2026-791805.4 MED

16.1%

——5UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)3d