CVE-2010-0494
Cross-domain vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 allows user-assisted...
Cross-domain vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 allows user-assisted remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted HTML document in a situation where the client user drags one browser window across another browser window, aka "HTML Element Cross-Domain Vulnerability."
Exploit likelihood
What each source reports
NVD Score used
Cross-domain vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 allows user-assisted remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted HTML document in a situation where the client user drags one browser window across another browser window, aka "HTML Element Cross-Domain Vulnerability."
- Record
CVE-2010-0494- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Cross-domain vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 allows user-assisted remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted HTML document in a situation where the client user drags one browser window across another browser window, aka "HTML Element Cross-Domain Vulnerability."
- Record
CVE-2010-0494- Updated
- 2026-11-02
EUVDEUVD-2010-0525 No score
Cross-domain vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 allows user-assisted remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted HTML document in a situation where the client user drags one browser window across another browser window, aka "HTML Element Cross-Domain Vulnerability."
- Record
EUVD-2010-0525- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7r9c-232f-pq69 No score
Cross-domain vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 allows user-assisted...
Cross-domain vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 allows user-assisted remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted HTML document in a situation where the client user drags one browser window across another browser window, aka "HTML Element Cross-Domain Vulnerability."
- Record
GHSA-7r9c-232f-pq69- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-0494 is a medium vulnerability (CVSS 4.3) in Microsoft Internet Explorer, published March 31, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 22.9%, the 97th percentile. No source names a fixed version.
References
us-cert.gov/cas/techalerts/TA10-089A.html
securityfocus.com/bid/39047
docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8553
vupen.com/english/advisories/2010/0744
securitytracker.com/id?1023773
nvd.nist.gov/vuln/detail/CVE-2010-0494
github.com/advisories/GHSA-7r9c-232f-pq69