Improper Restriction of Rendered UI Layers or Frames
CWE-1021
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
We track 54 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.8.
How this weakness is prevented
- Implementation: Use the frame-ancestors directive in the Content Security Policy, which is intended to define restrictions when it comes to allowing embedded content.
- Implementation: The use of X-Frame-Options (now partially obsolete as of September 2026) allows developers of web content to restrict the usage of their application within the form of overlays, frames, or iFrames. The developer can indicate from which domains can frame the content. The concept of X-Frame-Options is well documented, but implementation of this protection mechanism is in development to cover gaps; often, there is a need for allowing frames from multiple domains.
- Implementation: Use a frame-breaker script in each page that should not be framed. This is very helpful for legacy browsers that do not support the X-Frame-Options security feature previously mentioned (which is now partially obsolete).
- Implementation: In addition to frames or iframes as previously mentioned, the web application is expected to place restrictions on whether it is allowed to be rendered within objects, embed, or applet elements.
Latest Improper Restriction of Rendered UI Layers or Frames vulnerabilities
- 7.8 High severity
Android: Improper Restriction of Rendered UI Layers or Frames
In onCreate of multiple files, there is a possible way to trick the user into granting health permissions due to tapjacking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exp
- 8.1 High severity
bl-w1210m: Improper Restriction of Rendered UI Layers or Frames
LB-LINK BL-W1210M v2.0 was discovered to contain a clickjacking vulnerability via the Administrator login page. Attackers can cause victim users to perform arbitrary operations via interaction with crafted elements on the web page.
- 7.5 High severity
Firefox: Improper Restriction of Rendered UI Layers or Frames
Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash. This vulnerability affects Firefox < 124.
- 7.1 High severity
Plone CMS: Improper Restriction of Rendered UI Layers or Frames
A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element.
- 9.6 Critical severity
core: Improper Restriction of Rendered UI Layers or Frames
Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Options header, which specifies whether the web page is allowed to be framed. The omission of this and correlating headers fac
- 7.8 High severity
Android: Improper Restriction of Rendered UI Layers or Frames
In hasInputInfo of Layer.cpp, there is a possible bypass of user interaction requirements due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for ex
- 7.8 High severity
Android: Improper Restriction of Rendered UI Layers or Frames
In onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into enabling a malicious phone account due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution pri
- 7.5 High severity
Firefox ESR: Improper Restriction of Rendered UI Layers or Frames
When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed. This vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and Thunderbird < 91.1
- 7.8 High severity
Android: Improper Restriction of Rendered UI Layers or Frames
In onCreate of various files, there is a possible tapjacking/overlay attack. This could lead to local escalation of privilege or denial of server with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: A
- 7.3 High severity
Android: Improper Restriction of Rendered UI Layers or Frames
In onCreate of EnableAccountPreferenceActivity.java, there is a possible way to mislead the user into enabling a malicious phone account due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed.
- 7.3 High severity
Android: Improper Restriction of Rendered UI Layers or Frames
In onCreate of ReviewPermissionsActivity.java, there is a possible way to grant permissions for a separate app with API level < 23 due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User
- 7.8 High severity
Android: Improper Restriction of Rendered UI Layers or Frames
In the Framework, there is a possible way to enable a work profile without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploita
- 7.8 High severity
Android: Improper Restriction of Rendered UI Layers or Frames
In wifi.RequestToggleWifiActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.P
- 7.4 High severity
EcoStruxure EV Charging Expert (formerly known…: Improper Restriction of Rendered UI Layers or Frames
A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the product settings or user accounts when deceiving the user to use the web interface rendered within iframes. Affected Product: