CVEvulnerability

CVE-2004-2475

4.3 MEDIUM Published 2004-12-31 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2004-12-31
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N

Description

Cross-site scripting (XSS) vulnerability in Google Toolbar 2.0.114.1 allows remote attackers to inject arbitrary web script via about.html in the About section. NOTE: some followup posts suggest that the demonstration code's use of the res:// protocol does not cross privilege boundaries, since it is not allowed in the Internet Zone. Thus this might not be a vulnerability.

Affected configurations

• google toolbar 1.1.41 • google toolbar 1.1.42 • google toolbar 1.1.43 • google toolbar 1.1.44 • google toolbar 1.1.45 • google toolbar 1.1.47 • google toolbar 1.1.48 • google toolbar 1.1.49 • google toolbar 1.1.53 • google toolbar 1.1.54 • google toolbar 1.1.55 • google toolbar 1.1.56 • google toolbar 1.1.57 • google toolbar 1.1.58 • google toolbar 1.1.59 • google toolbar 1.1.60 • google toolbar 2.0.114.1

References