CVE-2026-0094
In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into approving access to certificates due to misl
CVSS
7.8
High
EPSS
0.1%
p0
KEV
—
Exploit Today
0
0-100
Published: Jun 1, 2026 · Last modified: Jul 22, 2026 · CWE-451
0.1%EPSS · 30 days0.1%
2026-09-232026-10-20
In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into approving access to certificates due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1094344.3 MED21.6%
——6Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attackers can render a counterfeit address bar showing a trusted origin over attacker-controlled content after a single user tap, enabling credential harvesting, malware delivery, or social engineering through fake login, update, or payment pages.2dCVE-2026-1097477.3 HIG19.5%
——6Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.3dCVE-2026-1097368.1 HIG24.0%
——7Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.3dCVE-2026-1093468.1 HIG19.1%
——6better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/token for a live session token.5dCVE-2026-1063805.4 MED10.7%
——3UI misrepresentation in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)15dCVE-2026-1063685.4 MED9.0%
——3UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)7d