Improper Restriction of Rendered UI Layers or Frames
CWE-1021
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
We track 54 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.8.
How this weakness is prevented
- Implementation: Use the frame-ancestors directive in the Content Security Policy, which is intended to define restrictions when it comes to allowing embedded content.
- Implementation: The use of X-Frame-Options (now partially obsolete as of September 2026) allows developers of web content to restrict the usage of their application within the form of overlays, frames, or iFrames. The developer can indicate from which domains can frame the content. The concept of X-Frame-Options is well documented, but implementation of this protection mechanism is in development to cover gaps; often, there is a need for allowing frames from multiple domains.
- Implementation: Use a frame-breaker script in each page that should not be framed. This is very helpful for legacy browsers that do not support the X-Frame-Options security feature previously mentioned (which is now partially obsolete).
- Implementation: In addition to frames or iframes as previously mentioned, the web application is expected to place restrictions on whether it is allowed to be rendered within objects, embed, or applet elements.
Latest Improper Restriction of Rendered UI Layers or Frames vulnerabilities
- 8.6 High severity
storybook: Improper Control of Generation of Code
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficie
- 8.8 High severity
Chrome: Improper Restriction of Rendered UI Layers or Frames
Clickjacking in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)
- 8.7 High severity
open-webui: Improper Neutralization of Input During Web Page Generation
Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-s
- 9.6 Critical severity
FortiPAM Chrome Extension: Improper Restriction of Rendered UI Layers or Frames
A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions may allow attacker to information disclosure via remote unauthenticated attack
- 7.8 High severity
iOS and iPadOS: Improper Restriction of Rendered UI Layers or Frames
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. Processing a maliciously crafted file may lead to unexpected app termination.
- 8.7 High severity
open-webui: Improper Neutralization of Input During Web Page Generation
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-
- 7.3 High severity
Android: Improper Restriction of Rendered UI Layers or Frames
In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation
- 7.4 High severity
ArcSearch: Improper Restriction of Rendered UI Layers or Frames
ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk.
- 7.5 High severity
Firefox: Improper Restriction of Rendered UI Layers or Frames
Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
- 7.2 High severity
electron: Protection Mechanism Failure
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler wit
- 7.1 High severity
nebula-mesh: Improper Restriction of Rendered UI Layers or Frames
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in `internal/web/` or `internal/api/` set the standard browser-security headers. `grep` for `Content-Security-Policy`,
- 7.5 High severity
Oracle Platform Security for Java: Improper Restriction of Rendered UI Layers or Frames
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged at
- 7.5 High severity
Secure Access: Improper Restriction of Rendered UI Layers or Frames
o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers with control of a malicious web site could use it to potentially steal credentials from an unwary administrator.
- 8.1 High severity
Microsoft Bing Search for iOS: Improper Restriction of Rendered UI Layers or Frames
Improper restriction of rendered ui layers or frames in Microsoft Bing App for IOS allows an unauthorized attacker to perform spoofing over a network.
- 7.4 High severity
Arc Search: Improper Restriction of Rendered UI Layers or Frames
Address bar spoofing in Arc Search for Android allows a remote attacker to display a trusted domain in the address bar while rendering attacker-controlled content, enabling phishing.
- 7.8 High severity
Android: Improper Restriction of Rendered UI Layers or Frames
In addWindow of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation
- 7.8 High severity
Android: Improper Restriction of Rendered UI Layers or Frames
In startAnimation of StageCoordinator.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitatio
- 8.6 High severity
Android: Improper Restriction of Rendered UI Layers or Frames
In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not
- 7.4 High severity
Dia: Improper Restriction of Rendered UI Layers or Frames
Missing about:blank indicator in custom-sized new windows in Dia before 1.9.0 on macOS could allow an attacker to spoof a trusted domain in the window title and mislead users about the current site.
- 8.2 High severity
TDC-X401GL: Improper Restriction of Rendered UI Layers or Frames
An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously crafted web pages, leading to the extraction of sensitive data.
- 7.5 High severity
ArcSearch: Improper Restriction of Rendered UI Layers or Frames
ArcSearch for iOS versions prior to 1.45.2 could display a different domain in the address bar than the content being shown after an iframe-triggered URI-scheme navigation, increasing spoofing risk.
- 7.4 High severity
ArcSearch: Improper Restriction of Rendered UI Layers or Frames
ArcSearch for Android versions prior to 1.12.6 could display a different domain in the address bar than the content being shown, enabling address bar spoofing after user interaction via crafted web content.
- 7.3 High severity
Android: Improper Restriction of Rendered UI Layers or Frames
In DefaultTransitionHandler.java, there is a possible way to unknowingly grant permissions to an app due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed
- 7.8 High severity
Android: Improper Restriction of Rendered UI Layers or Frames
In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for e
- 7.4 High severity
Dia: Improper Restriction of Rendered UI Layers or Frames
This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI (li
- 7.8 High severity
Android: Improper Restriction of Rendered UI Layers or Frames
In maybeShowDialog of ControlsSettingsDialogManager.kt, there is a possible overlay of the ControlsSettingsDialog due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interact
- 7.8 High severity
Android: Improper Restriction of Rendered UI Layers or Frames
In multiple locations, there is a possible privilege escalation due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 7.3 High severity
Android: Improper Restriction of Rendered UI Layers or Frames
In multiple locations, there is a possible way to mislead the user into enabling malicious phone calls forwarding due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is ne
- 7.3 High severity
Android: Improper Restriction of Rendered UI Layers or Frames
In finishTransition of Transition.java, there is a possible way to bypass touch filtering restrictions due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is need
- 7.1 High severity
Firefox: Improper Restriction of Rendered UI Layers or Frames
A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. *This issue only affects Android versions of Firefox.*. This vulnerability wa
- 7.5 High severity
HarmonyOS: Improper Restriction of Rendered UI Layers or Frames
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Improper Restriction of Rendered UI Layers or Frames
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 7.1 High severity
hushline: Improper Restriction of Rendered UI Layers or Frames
Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the productions server appeared to have been misconfigured and missed providing any content security policy or security headers. This could resul
- 7.5 High severity
HarmonyOS: Improper Restriction of Rendered UI Layers or Frames
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Improper Restriction of Rendered UI Layers or Frames
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 8.1 High severity
Firefox: Improper Restriction of Rendered UI Layers or Frames
Malicious websites may have been able to perform user intent confirmation through tapjacking. This could have led to users unknowingly approving the launch of external applications, potentially exposing them to underlying vulnerabilities. This vulnerability af
- 9.1 Critical severity
Firefox for iOS: Improper Restriction of Rendered UI Layers or Frames
Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in the padlock icon showing an HTTPS indicator incorrectly This vulnerability affects Firefox for iOS < 131.2.
- 7.8 High severity
Android: Improper Restriction of Rendered UI Layers or Frames
In setTransactionState of SurfaceFlinger.cpp, there is a possible way to perform tapjacking due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for ex
- 8.1 High severity
Firefox: Improper Restriction of Rendered UI Layers or Frames
A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. *This issue only affects Android versions of Firefox.* This vulnerability affects Firefox < 129.
- 7.3 High severity
Android: Improper Restriction of Rendered UI Layers or Frames
In hide of WindowState.java, there is a possible way to bypass tapjacking/overlay protection by launching the activity in portrait mode first and then rotating it to landscape mode. This could lead to local escalation of privilege with User execution privilege