Cyber Resilience

CWE · MITRE source

CWE-1021Improper Restriction of Rendered UI Layers or Frames

Abstraction: Base · CVEs in our corpus: 410

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

Last updated: 20 August 2026 20:22 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 6 mapping(s) from 2 framework(s): CAPEC 5 (mostly) · ATT&CK 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A06:2025 Insecure Design.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • PR.PS-06
  • AC-4 Information Flow Enforcement
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control Title Family Why it addresses this CWE
No NIST controls proposed yet.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1056 Input Capture←P →P

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2021-21132 8.19.60.23412021-02-09
CVE-2016-2496 7.59.80.00912016-06-13
CVE-2021-23274 7.59.80.01182021-03-23
CVE-2021-43048 7.59.80.01242021-11-16
CVE-2021-21111 6.99.60.01062021-01-08
CVE-2018-18496 6.88.80.01182019-02-28
CVE-2021-22866 6.88.80.01042021-05-14
CVE-2024-10004 6.89.10.00382024-10-15
CVE-2022-3167 6.78.80.00992022-09-08
CVE-2023-41897 6.78.80.00952023-10-19
CVE-2015-5686 6.68.80.00452020-02-27
CVE-2021-3734 6.58.80.00402021-08-26
CVE-2020-13119 6.38.10.00832020-09-24
CVE-2021-23976 6.38.10.01102021-02-26
CVE-2018-7491 6.17.50.01082018-02-26
CVE-2019-16371 6.18.20.01182019-09-16
CVE-2021-0433 6.18.00.00552021-04-13
CVE-2021-44683 6.18.20.00972022-03-25
CVE-2024-33377 6.18.10.00442024-06-14
CVE-2024-11700 6.18.10.00492024-11-26
CVE-2026-58595 6.18.10.00462026-07-14
CVE-2021-0302 6.07.80.00702021-02-10
CVE-2021-39692 6.07.80.00752022-03-16
CVE-2022-36319 6.07.50.00692022-12-22
CVE-2024-7523 6.08.10.00272024-08-06