« Volver al listado

CVE-2025-15032

Estado: AplazadaAlta (7.4)—

Missing about:blank indicator in custom-sized new windows in Dia before 1.9.0 on macOS could allow an attacker to spoof a trusted domain in the window title and mislead users about the current site.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Application Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

DIA — DIAAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-15032",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-15032",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-16T18:35:22.027061Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "59469e6c-7ea7-446f-8e43-06aa32c115e8",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.4,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "59469e6c-7ea7-446f-8e43-06aa32c115e8",
      "affectedData": [
        {
          "vendor": "The Browser Company of New York",
          "product": "Dia",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.9.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-16T19:16:16.220",
  "references": [
    {
      "url": "https://www.diabrowser.com/security/bulletins#CVE-2025-15032",
      "source": "59469e6c-7ea7-446f-8e43-06aa32c115e8"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "59469e6c-7ea7-446f-8e43-06aa32c115e8",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1021"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing about:blank indicator in custom-sized new windows in Dia before 1.9.0 on macOS could allow an attacker to spoof a trusted domain in the window title and mislead users about the current site."
    },
    {
      "lang": "es",
      "value": "La falta del indicador about:blank en nuevas ventanas de tamaño personalizado en Dia antes de la versión 1.9.0 en macOS podría permitir a un atacante suplantar un dominio de confianza en el título de la ventana y engañar a los usuarios sobre el sitio actual."
    }
  ],
  "lastModified": "2026-06-17T08:36:58.953",
  "sourceIdentifier": "59469e6c-7ea7-446f-8e43-06aa32c115e8"
}