Dia vulnerabilities

2 known vulnerabilities in Dia from The Browser Company of New York. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.4 High severity

  Dia: Improper Restriction of Rendered UI Layers or Frames

  CVE-2025-15032Jan 16, 2026The Browser Company of New York

  Missing about:blank indicator in custom-sized new windows in Dia before 1.9.0 on macOS could allow an attacker to spoof a trusted domain in the window title and mislead users about the current site.

• 7.4 High severity

  Dia: Improper Restriction of Rendered UI Layers or Frames

  CVE-2025-13132Nov 21, 2025The Browser Company of New York

  This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI (li