彙總 maxthon 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
歷史漏洞主要涉及 跨站腳本與緩衝區溢位 等問題，部分漏洞可能導致 應用程式崩潰，並影響 軟體部署與生產負載 相關場景。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2019-16647 | Unquoted Search Path in Maxthon 5.1.0 to 5.2.7 Browser for Windows. | [email protected] | 7.2 | 1.96% | 2019-10-29 | 2026-06-16 |
| CVE-2014-1449 | The Maxthon Cloud Browser application before 4.1.6.2000 for Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses the history API. | [email protected] | 5.0 | 1.92% | 2014-12-25 | 2026-06-16 |
| CVE-2010-5246 | Multiple untrusted search path vulnerabilities in Maxthon Browser 1.6.7.35 and 2.5.15 allow local users to gain privileges via a Trojan horse (1) RSRC32.dll or (2) dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .html file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. | [email protected] | 6.9 | 0.42% | 2012-09-07 | 2026-06-16 |
| CVE-2009-3018 | Maxthon Browser 3.0.0.145 Alpha with Ultramode does not properly block javascript: and data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains a javascript: URI, (2) entering a javascript: URI when specifying the content of a Refresh header, (3) injecting a Refresh header that contains JavaScript sequences in a data:text/html URI, or (4) entering a data:text/ht | [email protected] | 4.3 | 1.07% | 2009-08-31 | 2026-06-16 |
| CVE-2009-3006 | Maxthon Browser 2.5.3.80 UNICODE allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page. | [email protected] | 4.3 | 1.05% | 2009-08-28 | 2026-06-16 |
| CVE-2008-3667 | Stack-based buffer overflow in Maxthon Browser 2.0 and earlier allows remote attackers to execute arbitrary code via a long Content-type HTTP header. | [email protected] | 6.8 | 6.87% | 2008-08-13 | 2026-06-16 |
| CVE-2006-6985 | Cross-domain vulnerability in Maxthon 1.5.6 build 42 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280. | [email protected] | 5.0 | 1.08% | 2007-02-08 | 2026-06-16 |
| CVE-2005-1090 | Directory traversal vulnerability in the readFile and writeFile API for Maxthon 1.2.0 and 1.2.1 allows remote attackers to read or write arbitrary files. | [email protected] | 6.4 | 1.90% | 2005-05-02 | 2026-06-16 |
| CVE-2005-0905 | Maxthon 1.2.0 allows remote malicious web sites to obtain potentially sensitive data from the search bar via the m2_search_text property. | [email protected] | 2.6 | 2.32% | 2005-05-02 | 2026-06-16 |