Maxthon

    Dashboard / Vendors

    Products: 3
    Vulnerabilities: 11
    Known Exploited: 0
    0
    Critical Level Threats
    2
    High Level Threats
    7
    Medium Level Threats
    1
    Low Level Threats

    Vulnerabilities

    100806040200
    JanFebMarAprMayJunJulAugSepOctNovDec
    Critical Level Threats
    High Level Threats
    Medium Level Threats
    Low Level Threats

    Products Security index

    Actions
    Items Per Page

    Vulnerabilities

    CVE-2012-10032

    Maxthon3 about:history XCS Trusted Zone Code Execution

    Last Modified: Jul 28, 2026
    Published: Aug 05, 2025

    CVE-2019-16647

    Unquoted Search Path in Maxthon 5.1.0 to 5.2.7 Browser for Windows.

    Last Modified: Nov 21, 2024
    Published: Oct 29, 2019

    CVE-2014-1449

    The Maxthon Cloud Browser application before 4.1.6.2000 for Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses the history API.

    Last Modified: Apr 12, 2025
    Published: Dec 25, 2014

    CVE-2010-5246

    Multiple untrusted search path vulnerabilities in Maxthon Browser 1.6.7.35 and 2.5.15 allow local users to gain privileges via a Trojan horse (1) RSRC32.dll or (2) dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .html file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

    Last Modified: Apr 11, 2025
    Published: Sep 07, 2012

    CVE-2009-3018

    Maxthon Browser 3.0.0.145 Alpha with Ultramode does not properly block javascript: and data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains a javascript: URI, (2) entering a javascript: URI when specifying the content of a Refresh header, (3) injecting a Refresh header that contains JavaScript sequences in a data:text/html URI, or (4) entering a data:text/html URI with JavaScript sequences when specifying the content of a Refresh header; does not properly block data: URIs in Location headers in HTTP responses, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (5) injecting a Location header that contains JavaScript sequences in a data:text/html URI or (6) entering a data:text/html URI with JavaScript sequences when specifying the content of a Location header; and does not properly handle javascript: URIs in HTML links within (a) 301 and (b) 302 error documents sent from web servers, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (7) injecting a Location HTTP response header or (8) specifying the content of a Location HTTP response header.

    Last Modified: Apr 23, 2026
    Published: Aug 31, 2009
    Items Per Page