CVE-2006-3227
Interpretation conflict between Internet Explorer and other web browsers such as Mozilla, Opera,...
Interpretation conflict between Internet Explorer and other web browsers such as Mozilla, Opera, and Firefox might allow remote attackers to modify the visual presentation of web pages and possibly bypass protection mechanisms such as content filters via ASCII characters with the 8th bit set, which could be stripped by Internet Explorer to render legible text, but not when using other browsers. NOTE: there has been significant discussion about this issue, and as of 20060625, it is not clear where the responsibility for this issue lies, although it might be due to vagueness within the associated standards. NOTE: this might only be exploitable with certain encodings.
Exploit likelihood
What each source reports
NVD Score used
2.6
Interpretation conflict between Internet Explorer and other web browsers such as Mozilla, Opera, and Firefox might allow remote attackers to modify the visual presentation of web pages and possibly bypass protection mechanisms such as content filters via ASCII characters with the 8th bit set, which could be stripped by Internet Explorer to render legible text, but not when using other browsers. NOTE: there has been significant discussion about this issue, and as of 20060625, it is not clear where the responsibility for this issue lies, although it might be due to vagueness within the associated standards. NOTE: this might only be exploitable with certain encodings.
- Record
CVE-2006-3227- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Interpretation conflict between Internet Explorer and other web browsers such as Mozilla, Opera, and Firefox might allow remote attackers to modify the visual presentation of web pages and possibly bypass protection mechanisms such as content filters via ASCII characters with the 8th bit set, which could be stripped by Internet Explorer to render legible text, but not when using other browsers. NOTE: there has been significant discussion about this issue, and as of 20060625, it is not clear where the responsibility for this issue lies, although it might be due to vagueness within the associated standards. NOTE: this might only be exploitable with certain encodings.
- Record
CVE-2006-3227- Updated
- 2026-11-02
EUVDEUVD-2006-3224 No score
Interpretation conflict between Internet Explorer and other web browsers such as Mozilla, Opera, and Firefox might allow remote attackers to modify the visual presentation of web pages and possibly bypass protection mechanisms such as content filters via ASCII characters with the 8th bit set, which could be stripped by Internet Explorer to render legible text, but not when using other browsers. NOTE: there has been significant discussion about this issue, and as of 20060625, it is not clear where the responsibility for this issue lies, although it might be due to vagueness within the associated standards. NOTE: this might only be exploitable with certain encodings.
- Record
EUVD-2006-3224- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4mpw-2952-v468 No score
Interpretation conflict between Internet Explorer and other web browsers such as Mozilla, Opera,...
Interpretation conflict between Internet Explorer and other web browsers such as Mozilla, Opera, and Firefox might allow remote attackers to modify the visual presentation of web pages and possibly bypass protection mechanisms such as content filters via ASCII characters with the 8th bit set, which could be stripped by Internet Explorer to render legible text, but not when using other browsers. NOTE: there has been significant discussion about this issue, and as of 20060625, it is not clear where the responsibility for this issue lies, although it might be due to vagueness within the associated standards. NOTE: this might only be exploitable with certain encodings.
- Record
GHSA-4mpw-2952-v468- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-3227 is a low vulnerability (CVSS 2.6) in Microsoft Internet Explorer, published June 26, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 13.5%, the 96th percentile. No source names a fixed version.
References
securityfocus.com/archive/1/438051/100/0/threaded
exchange.xforce.ibmcloud.com/vulnerabilities/27288
securityfocus.com/archive/1/438163/100/0/threaded
securityfocus.com/archive/1/438358/100/0/threaded
securityfocus.com/archive/1/438066/100/0/threaded
securityfocus.com/archive/1/437948/100/0/threaded
Show 8 moreShow less
ha.ckers.org/blog/20060621/us-ascii-xss-part-2
securityfocus.com/archive/1/438049/100/0/threaded
ha.ckers.org/blog/20060621/malformed-ascii-bypasses-filters
securityfocus.com/archive/1/438154/100/0/threaded
securityfocus.com/archive/1/438359/100/0/threaded
osvdb.org/28376
nvd.nist.gov/vuln/detail/CVE-2006-3227
github.com/advisories/GHSA-4mpw-2952-v468