CVE-2025-15032 HIGH

CVE-2025-15032: CVE-2025-15032: Increased Spoofing risk; custom new window missing about:blank

Vendor The Browser Company Of New York

Product Dia

Weakness CWE-1021

Published January 16, 2026

Last update January 16, 2026

View on NVD All CVEs

CVSS base score

7.4/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality None

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

What the vulnerability does

01Description

Missing about:blank indicator in custom-sized new windows in Dia before 1.9.0 on macOS could allow an attacker to spoof a trusted domain in the window title and mislead users about the current site.

Key dates

02Disclosure timeline

January 16, 2026 CVE published

January 16, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-15032 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1021.html

Related vulnerabilities

CVE-2025-15032: CVE-2025-15032: Increased Spoofing risk; custom new window missing about:blank

01Description

02Disclosure timeline

03References

04Related CVE