Microsoft Internet Explorer Frame Location Cross Domain Security Bypass Vulnerability

Microsoft Internet Explorer Frame Location Cross Domain Security Bypass Vulnerability

Microsoft Internet Explorer is prone to a cross-domain scripting security-bypass vulnerability because the application fails to properly enforce the same-origin policy.

An attacker can exploit this issue to change the location of a frame from a different domain. This allows the attacker to execute arbitrary code in a frame of the same window as content from a different domain. Successful exploits will allow the attacker to access information from the parent document via DOM components that are not domain-reliant (such as the 'onmousedown' event).

Internet Explorer 6, 7, and 8 Beta 1 are vulnerable; other versions may also be affected.