Vulnerability record · CVE-2003-0816 · published 3 February 2004
CVE-2003-0816: Internet Explorer zone restriction bypass via script URLs
Microsoft · Ie
Internet Explorer 6 SP1 and earlier fails to enforce zone restrictions when handling file: URLs containing JavaScript, allowing script to run in the context of another domain. Multiple vectors are documented, including NavigateAndFind, window.open, base tag href manipulation, Iframe loading of the search window, and caching javascript: URLs in history. This undermines the browser's cross-domain and zone trust model, which is the core defense separating untrusted web content from local or privileged zones.
Description
Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
medium priorityThe flaw is a serious cross-domain bypass with a high EPSS score, but it affects a long-obsolete browser and the record shows no KEV listing or confirmed in-the-wild exploitation.
What it is
Internet Explorer 6 SP1 and earlier fails to enforce zone restrictions when handling file: URLs containing JavaScript, allowing script to run in the context of another domain. Multiple vectors are documented, including NavigateAndFind, window.open, base tag href manipulation, Iframe loading of the search window, and caching javascript: URLs in history. This undermines the browser's cross-domain and zone trust model, which is the core defense separating untrusted web content from local or privileged zones.
Impact
An attacker can execute script in a victim's browser under a domain or zone they should not control, enabling theft of cookies or data and other actions permitted to the impersonated origin. The CVSS 2.0 vector (C:P/I:P/A:P) indicates partial confidentiality, integrity and availability impact.
Attack surface
Reached remotely over the network with no authentication required (AV:N/AC:L/Au:N); the victim must load attacker-controlled content or follow a crafted link, so some user interaction is implied by the browser-based vectors. No affected version list beyond IE 6 SP1 and earlier is given in the record.
Exploitation
Not listed in CISA KEV and no reference carries an exploit tag, but EPSS is high (0.48374, 98.8th percentile) and the references are public Bugtraq and SafeCenter proof-of-concept pages, indicating public technical detail exists. The record does not confirm active exploitation in the wild.
What to do
- Apply Microsoft security bulletin MS03-048, the vendor patch referenced in the record, or upgrade to a supported Internet Explorer version.
- Disable or restrict ActiveX and script execution for untrusted zones, and raise Internet zone restrictions.
- Block or filter file: URLs and javascript: URLs delivered from web content at the proxy or browser policy level.
- Retire IE 6 SP1 and earlier from any environment still running it, since the product is long out of support.
- Educate users not to follow unsolicited links or open untrusted pages in legacy IE.
Detection
- Monitor proxy and web logs for requests containing file: or javascript: URL patterns in query strings or referrers.
- Alert on browser processes loading local file: URLs immediately after web navigation.
- Review endpoint telemetry for IE 6 or earlier versions still present in the estate.
- Hunt for known proof-of-concept page names from the SafeCenter references in web or DNS logs.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2003-0816 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2003-0816), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
