Vulnerability record · CVE-2015-0072 · published 7 February 2015
CVE-2015-0072: Internet Explorer Universal XSS Same Origin Policy Bypass
Microsoft · Internet Explorer
Internet Explorer 9 through 11 contains a cross-site scripting flaw that lets a remote attacker bypass the Same Origin Policy using crafted IFRAME elements and an eval of a WindowProxy object. Because it defeats the browser's core origin boundary, script injected from one site can run in the context of another, which is why it was called Universal XSS.
Description
Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka "Universal XSS (UXSS)."
AV:N/AC:M/Au:N/C:N/I:P/A:N
Automated analysis
high priorityThe flaw breaks the Same Origin Policy in a widely deployed browser, public exploit code exists and EPSS is near the top of the distribution, though the CVSS 2.0 base score is only 4.3 and KEV does not list it.
What it is
Internet Explorer 9 through 11 contains a cross-site scripting flaw that lets a remote attacker bypass the Same Origin Policy using crafted IFRAME elements and an eval of a WindowProxy object. Because it defeats the browser's core origin boundary, script injected from one site can run in the context of another, which is why it was called Universal XSS.
Impact
An attacker can inject arbitrary script or HTML into pages from other origins, enabling session theft, credential phishing and full control of content displayed to the victim. The CVSS 2.0 vector shows only partial integrity impact, so confidentiality and availability effects are not reflected in that score.
Attack surface
Reached over the network by getting a victim to load a malicious or compromised page in Internet Explorer 9 to 11; no authentication is required, but the CVSS vector indicates medium access complexity and some user interaction is implied. The flaw is triggered by the IFRAME and WindowProxy handling in the browser itself, not by a server-side component.
Exploitation
Public proof-of-concept exploit code is referenced, and EPSS is very high at 0.71698 (99.391st percentile), but the CVE is not listed in CISA KEV and no ransomware usage is documented.
What to do
- Apply Microsoft security bulletin MS15-018, which addresses this vulnerability, or move off Internet Explorer 9 through 11 entirely.
- If patching cannot be done immediately, restrict or disable Internet Explorer usage for untrusted web content and enforce a modern supported browser.
- Enable and enforce Enhanced Protected Mode and 64-bit IE where operationally possible to reduce the reach of injected script.
- Block or tightly control IFRAME-heavy and untrusted third-party content in IE through proxy or content filtering policy.
- Monitor for and remove any legacy IE dependencies that keep affected versions in production.
Detection
- Hunt proxy and web logs for IE 9 to 11 user agents accessing known exploit-hosting or proof-of-concept URLs tied to this CVE.
- Monitor endpoint process and browser telemetry for IE rendering pages that load nested IFRAMEs from unrelated origins in quick succession.
- Alert on suspicious script execution or credential submission originating from pages whose origin does not match the hosting site.
- Track unpatched IE 9 to 11 installations via asset inventory and vulnerability scanning and flag them for remediation.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2015-0072 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-0072), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
