Vulnerability record · CVE-2006-3280 · published 28 June 2006
CVE-2006-3280: Microsoft Internet Explorer 6 cross-domain information disclosure via object tag
Microsoft · Internet Explorer
Microsoft Internet Explorer 6.0 fails to enforce cross-domain boundaries when an object tag's data parameter points to an attacker-controlled link that returns a Location HTTP header referencing the target site. The redirected content then becomes readable through the object's outerHTML attribute, allowing one domain to read restricted content from another. This breaks the browser's same-origin policy and exposes data that should remain isolated between sites.
Description
Cross-domain vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, aka "Redirect Cross-Domain Information Disclosure Vulnerability."
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityThe flaw breaks the same-origin policy with a high CVSS 2.0 score of 7.5 and high EPSS, but it affects only legacy Internet Explorer 6.0 and is not known to be exploited in the wild.
What it is
Microsoft Internet Explorer 6.0 fails to enforce cross-domain boundaries when an object tag's data parameter points to an attacker-controlled link that returns a Location HTTP header referencing the target site. The redirected content then becomes readable through the object's outerHTML attribute, allowing one domain to read restricted content from another. This breaks the browser's same-origin policy and exposes data that should remain isolated between sites.
Impact
An attacker can read restricted content from other domains visited in the same browser session, leading to disclosure of sensitive information such as page content or tokens. The CVSS vector also indicates partial integrity and availability impact, though the description centers on information disclosure.
Attack surface
Reached remotely over the network with no authentication required, per the AV:N/AC:L/Au:N vector. Exploitation requires the victim to load attacker-controlled content in Internet Explorer 6.0, typically via a crafted page or link, so some user interaction is implied by the browser-based delivery.
Exploitation
Not listed in CISA KEV and no ransomware associations are documented. EPSS is high at 0.55917 (99th percentile), and references include vendor and US-CERT advisories plus public full-disclosure posts, indicating public technical detail is available.
What to do
- Apply Microsoft security bulletin MS06-042 or the corresponding Internet Explorer cumulative update, which addresses this issue.
- Upgrade from Internet Explorer 6.0 to a supported, patched browser version.
- Enforce same-origin and cross-domain isolation through browser security settings and, where feasible, restrict legacy IE usage.
- Limit browsing of untrusted sites in IE 6.0 environments and segment legacy systems that cannot be upgraded.
Detection
- Monitor for object tags with data parameters that reference attacker-controlled URLs returning Location redirects to internal or sensitive sites.
- Look for client-side script accessing outerHTML on object elements in ways consistent with cross-domain data extraction.
- Review proxy and web logs for redirect chains from untrusted origins to internal resources in IE 6.0 user traffic.
- Track legacy IE 6.0 usage on the network as an exposure indicator.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-3280 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-3280), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
