CVE-2004-1155

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 12.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-12-10 · updated 2026-06-16

Description

Internet Explorer 5.01 through 6 allows remote attackers to spoof arbitrary web sites by injecting content from one window into another window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability. NOTE: later research shows that Internet Explorer 7 on Windows XP SP2 is also vulnerable.

Affected products

Microsoft Ie: 5.0.1, 5.2.3, 6.0-sp1, 6.0-sp2, 7.0-windows_xp_sp2
Microsoft Internet Explorer 11: 5.0.1, 5.0.1-sp1, 5.0.1-sp2, 5.0.1-sp3, 5.0.1-sp4, 5.5 (+4)

References

http://secunia.com/advisories/13251/
http://secunia.com/advisories/22628
http://secunia.com/multiple_browsers_window_injection_vulnerability_test/
http://secunia.com/secunia_research/2004-13/advisory/
http://www.securityfocus.com/archive/1/449917/100/0/threaded
http://www.securityfocus.com/bid/11855
http://secunia.com/advisories/13251/
http://secunia.com/advisories/22628
http://secunia.com/multiple_browsers_window_injection_vulnerability_test/
http://secunia.com/secunia_research/2004-13/advisory/
http://www.securityfocus.com/archive/1/449917/100/0/threaded
http://www.securityfocus.com/bid/11855

Get alerted when CVE-2004-1155 or the next vulnerability affects your stack