CVE-2025-15032

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

Missing about:blank indicator in custom-sized new windows in Dia before 1.9.0 on macOS could allow an attacker to spoof a trusted domain in the window title and mislead users about the current site.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-1021

Affected software

Vendor	Product	Versions
The Browser Company of New York	Dia	< 1.9.0

References

https://www.diabrowser.com/security/bulletins#CVE-2025-15032

Timeline

Published: Jan 16, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-150336.5A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain c CVE-2025-150349.8A security flaw has been discovered in itsourcecode Student Management System 1.0. This affects an unknown part of the file /record.php. The CVE-2025-150357.3Improper Input Validation vulnerability in TP-Link Archer AXE75 v1.6 (vpn modules) allows an authenticated adjacent attacker to delete arbit CVE-2025-1503610.0A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file o CVE-2025-150376.8An Incorrect Permission Assignment vulnerability exists in the ASUS Business System Control Interface driver. This vulnerability can be trig CVE-2025-150386.9An Out-of-Bounds Read vulnerability exists in the ASUS Business System Control Interface driver. This vulnerability can be triggered by an u CVE-2025-150399.4The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication ste CVE-2025-15046.5The Post Lockdown plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.0.2 via the 'pl_autocom CVE-2025-150417.2The BackWPup – WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to pr CVE-2025-150435.4The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'start_migration'CVE-2025-150449.8A vulnerability was detected in Tenda WH450 1.0.0.18. Impacted is an unknown function of the file /goform/NatStaticSetting. The manipulation CVE-2025-150459.8A flaw has been found in Tenda WH450 1.0.0.18. The affected element is an unknown function of the file /goform/Natlimit of the component HTT