What’s Vulnerable › Vulnerabilities

CVE-2007-4431

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2007-08-20 · updated 2026-06-16

Description

Cross-domain vulnerability in Apple Safari for Windows 3.0.3 and earlier allows remote attackers to bypass the Same Origin Policy, with access from local zones to external domains, via a certain body.innerHTML property value, aka "classic JavaScript frame hijacking."

Affected products

• Apple Safari: through 3.0.3

References

• http://osvdb.org/46720
• http://sla.ckers.org/forum/read.php?3%2C14151
• http://www.0x000000.com/index.php?i=420
• http://www.securityfocus.com/bid/25355
• http://www.thespanner.co.uk/2007/08/17/safari-beta-zero-day/
• http://osvdb.org/46720
• http://sla.ckers.org/forum/read.php?3%2C14151
• http://www.0x000000.com/index.php?i=420
• http://www.securityfocus.com/bid/25355
• http://www.thespanner.co.uk/2007/08/17/safari-beta-zero-day/

Get alerted when CVE-2007-4431 or the next vulnerability affects your stack