Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Internet Explorer may run embedded objects in wrong zone

CVE-2006-1190 · published 20 years ago
Summary

Versions 5.01 through 6 of Internet Explorer can sometimes place embedded content in the wrong security area, which could let a remote attacker run code on a user's computer. This happens when the browser creates certain objects dynamically. Upgrade to a newer browser version or apply the latest security updates to protect against this risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft internet_explorer 5.01
5.1
5.5
6.0
cpe:2.3:a:microsoft:internet_explorer:5.01:*:*:*:*:*:*:*
Original advisory text
Microsoft Internet Explorer 5.01 through 6 does not always return the correct IOleClientSite information when dynamically creating an embedded object, which could cause Internet Explorer to run the...
Microsoft Internet Explorer 5.01 through 6 does not always return the correct IOleClientSite information when dynamically creating an embedded object, which could cause Internet Explorer to run the object in the wrong security context or zone, and allow remote attackers to execute arbitrary code.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
62% chance of attack within 30 days
Timeline
Published11 Apr 2006
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2006-1190 · NVD
Track software like this
Free during beta