CVE-2009-3006 describes a spoofing vulnerability in Maxthon Browser version 2.5.3.80. This flaw allows remote attackers to manipulate the address bar using a crafted window.open call with a relative URI, displaying an arbitrary URL to the user. The attack requires user interaction, typically by visiting an attacker-controlled webpage that then presents a spoofed login form for a legitimate site. While no active exploitation or public exploit code is noted, the vulnerability could lead to phishing attacks.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.5.3.80CPE matchmatch criteria | cpe:2.3:a:maxthon:maxthon_browser:2.5.3.80:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:N/I:P/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.