The vulnerability allows a malicious web page to invoke the Fullscreen API and display a counterfeit address bar that shows a trusted domain while actually presenting attacker‑controlled content. This misrepresentation can trick users into believing they are on a legitimate site, leading them to disclose credentials or other sensitive information. The weakness arises from a logic flaw that fails to provide a persistent fullscreen notification or trusted origin indicator, and is identified as CWE‑451.

Maxthon Technology Limited’s Maxthon Browser for Android versions earlier than 7.5.8.103 are affected. No other vendors or product lineages are listed in the advisory.

The CVSS score of 5.1 indicates moderate exploitability. No EPSS score was supplied, and the vulnerability is not in the CISA KEV catalog, suggesting limited current exploitation activity. The typical attack vector is a crafted web page that users visit and then tap to enter fullscreen mode; the attacker needs the user to interact with the page, making the exploit semi‑dependent on user behavior but still viable in phishing campaigns.