Vulnerability record · CVE-2001-1410 · published 18 August 2003
CVE-2001-1410: Internet Explorer chromeless popup window spoofing
Microsoft · Internet Explorer
Internet Explorer 6 and earlier allows remote attackers to create chromeless windows via the JavaScript window.createPopup method. Because the resulting window lacks normal browser chrome, an attacker can mimic the victim's display and use social engineering to conduct unauthorized activities or steal sensitive data.
Description
Internet Explorer 6 and earlier allows remote attackers to create chromeless windows using the Javascript window.createPopup method, which could allow attackers to simulate a victim's display and conduct unauthorized activities or steal sensitive data via social engineering.
AV:N/AC:L/Au:N/C:P/I:N/A:N
Automated analysis
medium priorityThe flaw enables convincing UI spoofing and has high EPSS, but it affects only legacy Internet Explorer and requires user interaction, limiting real-world exposure.
What it is
Internet Explorer 6 and earlier allows remote attackers to create chromeless windows via the JavaScript window.createPopup method. Because the resulting window lacks normal browser chrome, an attacker can mimic the victim's display and use social engineering to conduct unauthorized activities or steal sensitive data.
Impact
An attacker can present a forged interface that appears to be the victim's own system or application, tricking the user into revealing sensitive data or performing unauthorized actions. The flaw itself yields partial confidentiality impact; integrity and availability are not affected per the CVSS vector.
Attack surface
Reachable over the network with no authentication required (AV:N/AC:L/Au:N), delivered through a web page that invokes window.createPopup in Internet Explorer. Exploitation depends on the victim visiting the page and interacting with the spoofed window, so user interaction is effectively required despite the vector not encoding it.
Exploitation
Not listed in CISA KEV, but public exploit and vendor advisory references exist and EPSS is high (0.50549, 98.86th percentile), indicating elevated likelihood of exploitation activity.
What to do
- Upgrade to a supported browser or a patched Internet Explorer version; this is a legacy product no longer receiving security fixes.
- Disable or restrict JavaScript execution for untrusted sites in any remaining IE deployments.
- Block or retire Internet Explorer usage through application allowlisting and browser policy.
- Educate users on window spoofing and social engineering, especially prompts that appear to originate from the local system.
- Monitor for legacy IE traffic on the network and treat it as a risk indicator.
Detection
- Search web proxy or IDS logs for pages containing window.createPopup or chromeless window patterns.
- Alert on Internet Explorer user-agent strings reaching external sites from managed endpoints.
- Review endpoint process telemetry for iexplore.exe execution in environments where it should be retired.
- Correlate user reports of unexpected full-screen or chrome-less windows with recent browsing activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2001-1410 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2001-1410), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
