Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

Internet Explorer 7 can trap users and fake address bar

CVE-2007-1091 · published 19 years ago
Summary

Internet Explorer 7 lets a malicious web page keep a visitor on the site, change the look of the address bar, and make phishing attacks easier. This happens because the browser runs certain JavaScript code when a page is being left. Update the browser or switch to a more modern, supported web browser to eliminate the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft ie 6.0
7.0
cpe:2.3:a:microsoft:ie:6.0:sp1:*:*:*:*:*:*
microsoft internet_explorer 6.0
cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*
Original advisory text
Microsoft Internet Explorer 7 allows remote attackers to prevent users from leaving a site, spoof the address bar, and conduct phishing and other attacks via onUnload Javascript handlers.
Microsoft Internet Explorer 7 allows remote attackers to prevent users from leaving a site, spoof the address bar, and conduct phishing and other attacks via onUnload Javascript handlers.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.8 Medium
Exploitation
26% chance of attack within 30 days
Timeline
Published26 Feb 2007
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2007-1091 · NVD
Track software like this
Free during beta