GCVE - cpe:2.3:a:maxthon_international_ltd.:maxthon3

Approved changes feed: RSS · Atom

cpe:2.3:a:maxthon_international_ltd.:maxthon3_browser:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Maxthon International Ltd. (`a23e2d66-d61a-5931-a096-5e18c393be4b`)
Product	Maxthon3 Browser (`d177acbf-b54f-5772-9eec-4e35d4c04147`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2012-10032`	vulnerable	2026-06-08 05:00:46.890990	Maxthon3 about:history XCS Trusted Zone Code Execution Maxthon3 version 3.2.2 build 1000 and prior are vulnerable to cross context scripting (XCS) via the about:history page. The browser’s trusted zone improperly handles injected script content, allowing attackers to execute arbitrary JavaScript in a privileged context. This flaw enables modification of browser configuration and execution of arbitrary code through Maxthon’s exposed DOM APIs, including maxthon.program.Program.launch() and maxthon.io.writeDataURL(). Exploitation requires user interaction, typically by visiting a malicious webpage that triggers the injection. Published: 2025-08-05T20:03:14.736Z Updated: 2026-07-28T01:46:24.622Z Open on db.gcve.eu Reference links https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/browser/maxthon_history_xcs.rb https://www.exploit-db.com/exploits/23225 http://blog.malerisch.net/2012/12/maxthon-cross-context-scripting-xcs-about-history-rce.html https://www.maxthon.com/ https://www.fortiguard.com/encyclopedia/ips/34203	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.