Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using t

Summary

Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability."

Timeline

1. Dec 8, 2005, 11:00 AM UTCCVE published
2. Aug 7, 2024, 11:31 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

References 13