CVE-2004-1158: Kde Konqueror

High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days.

Konqueror 3.x up to 3.2.2-6, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window or tab whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability.

Affected products

• Kde Konqueror: version 2.1.1 only; version 2.1.2 only; version 2.2.1 only; version 2.2.2 only; version 3.0 only; version 3.0.1 only; …
• Mandrakesoft Mandrake Linux: version 10.0 only; version 10.1 only
• Red Hat Fedora Core: version core_2.0 only; version core_3.0 only

Published 2005-01-10. Last modified 2026-06-16.