CWE-1021Improper Restriction of Rendered UI Layers or Frames

Abstraction: Base · CVEs in our corpus: 426

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

Last updated: 14 October 2026 20:41 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 1 mapping(s) from 1 framework(s): ATT&CK 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A06:2025 Insecure Design.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-06
AC-4 Information Flow Enforcement

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2021-21132`	8.1	9.6	0.2341	2021-02-09
`CVE-2021-43048`	7.6	9.8	0.0128	2021-11-16
`CVE-2016-2496`	7.5	9.8	0.0091	2016-06-13
`CVE-2021-23274`	7.5	9.8	0.0122	2021-03-23
`CVE-2021-21111`	7.0	9.6	0.0108	2021-01-08
`CVE-2018-18496`	6.8	8.8	0.0118	2019-02-28
`CVE-2021-22866`	6.8	8.8	0.0104	2021-05-14
`CVE-2022-3167`	6.8	8.8	0.0117	2022-09-08
`CVE-2024-10004`	6.8	9.1	0.0038	2024-10-15
`CVE-2023-41897`	6.7	8.8	0.0095	2023-10-19
`CVE-2026-84388`	6.7	9.6	0.0038	2026-09-22
`CVE-2015-5686`	6.6	8.8	0.0045	2020-02-27
`CVE-2021-3734`	6.5	8.8	0.0040	2021-08-26
`CVE-2020-13119`	6.3	8.1	0.0083	2020-09-24
`CVE-2021-23976`	6.3	8.1	0.0110	2021-02-26
`CVE-2026-58595`	6.2	8.1	0.0069	2026-07-14
`CVE-2026-87995`	6.2	8.7	0.0042	2026-09-09
`CVE-2018-7491`	6.1	7.5	0.0108	2018-02-26
`CVE-2019-16371`	6.1	8.2	0.0118	2019-09-16
`CVE-2021-0433`	6.1	8.0	0.0055	2021-04-13
`CVE-2021-44683`	6.1	8.2	0.0097	2022-03-25
`CVE-2024-33377`	6.1	8.1	0.0044	2024-06-14
`CVE-2024-11700`	6.1	8.1	0.0048	2024-11-26
`CVE-2026-74978`	6.1	8.1	0.0038	2026-08-18
`CVE-2021-0302`	6.0	7.8	0.0070	2021-02-10