CVE-2005-4089: Microsoft Ie

High severity, CVSS 7.1. EPSS: 22.1% chance of exploitation in the next 30 days.

Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability."

Affected products

• Microsoft Ie: version 6.0 only
• Microsoft Internet Explorer: version 6.0 only

Published 2005-12-08. Last modified 2026-06-16.