Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119730Maxthon Browser for Android < 7.5.8.103 Fullscreen Address Bar Spoofing

Medium 4.3

In plain English

A medium-severity security flaw in Maxthon Browser for Android from Maxthon Technology Limited. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 83.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote attackers to misrepresent a page's origin by exploiting the lack of a persistent fullscreen notification or trusted origin indicator when the Fullscreen API is invoked. Attackers can craft a malicious web page that renders a counterfeit address bar showing a trusted domain while displaying attacker-controlled content, tricking users who perform a single tap to enter fullscreen into disclosing credentials via phishing.

Affected products (as reported)

Vendor	Product	Versions
Maxthon Technology Limited	Maxthon Browser for Android	0 – before 7.5.8.103

Weakness: CWE-451 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

Release Notes release-notes, patch
VulnCheck Advisory: Maxthon Browser for Android < 7.5.8.103 Fullscreen Address Bar Spoofing third-party-advisory