CVE-2005-4089

no score yetEPSS 22%

Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability."

EPSS: 22% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWE: CWE-264
Published: 2005-12-08
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

microsoft:ie
microsoft:internet_explorer

References

http://secunia.com/advisories/17564
http://securitytracker.com/id?1016291
http://www.hacker.co.il/security/ie/css_import.html
http://www.securityfocus.com/bid/15660
http://www.vupen.com/english/advisories/2005/2804

Check your stack JSON