CVE-2025-31266
Medium · 4.3CVSS
4.3
EPSS
0.2%
Published
Nov 21, 2025
CISA due date
—
The record
A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name. This issue is fixed in Safari 18.5, macOS Sequoia 15.5. A website may be able to spoof the domain name in the title of a pop-up window.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-87649 UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a… CWE-451
- CVE-2026-87653 UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36… CWE-451
- CVE-2026-87635 UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-451
- CVE-2026-87624 UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36… CWE-451
- CVE-2026-87597 UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 153.0.8010.36… CWE-451
- CVE-2026-87583 UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36… CWE-451
- CVE-2026-87567 UI misrepresentation in UrlFormatting in Google Chrome prior to 153.0.8010.36 allowed a… CWE-451
- CVE-2026-87559 UI misrepresentation in UI in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-451