Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.6

Safari before 5.0.4 lets remote attackers run scripts

CVE-2011-0169 · published 15 years ago
Summary

Safari versions older than 5.0.4 allow a specially crafted web page to break the browser’s normal security barriers when the developer tool called Web Inspector is open. An attacker could use this to inject malicious code and steal data from other sites you visit. Upgrade Safari to version 5.0.4 or later, or disable the Web Inspector feature until you can update.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
apple safari <= 5.0.3
1.0
1.0.0
1.0.0b1
1.0.0b2
1.0.1
1.0.2
1.0.3
1.1
1.1.0
1.1.1
1.2
40 more version ranges
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
apple webkit All versions
cpe:2.3:a:apple:webkit:*:*:*:*:*:*:*:*
Original advisory text
WebKit in Apple Safari before 5.0.4, when the Web Inspector is used, does not properly handle the window.console._inspectorCommandLineAPI property, which allows user-assisted remote attackers to by...
WebKit in Apple Safari before 5.0.4, when the Web Inspector is used, does not properly handle the window.console._inspectorCommandLineAPI property, which allows user-assisted remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted web site.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
2.6 Low
Exploitation
1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published11 Mar 2011
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2011-0169 · NVD
Track software like this
Free during beta