The web user interface (UI) does not properly represent critical
information to the user, allowing the information - or its source -
to be obscured or spoofed. This is often a component in phishing attacks.



If an attacker can cause the UI to display erroneous data, or to otherwise
convince the user to display information that appears to come from a
trusted source, then the attacker could trick the user into performing the
wrong action. An example of this vulnerability is the possibility to
control the `src` attribute of an iframe tag using a query string
parameter.