🎯 New Report #3679471: HTML Injection in Transaction Confirmation Dialog via Address Book Description Enables UI Spoofing Before Fund Transfer
🔺Severity: Medium
👽 Reporter: fg0x0
⭐️ Reputation: 587
🛠 State: resolved
💼 Team: Monero
💵 Bounty: null
🕐 Submitted: 2026-04-17
⏰ Disclosed: 2026-08-20 23:49:03
📝 Summary: The Monero GUI wallet was found to render address book descriptions as HTML in the transaction confirmation dialog without sanitizing the input. This vulnerability could enable an attacker to craft a malicious Monero URI or QR code, which when added to the victim's address book, would display arbitrary HTML in the confirmation dialog before fund transfer. This could be used to spoof the recipient's details and mislead the victim into confirming a transaction to the attacker's address.
📂 Report JSON File: 3679471
@hackeronereports