CVE-2006-7066: Microsoft Internet Explorer

High severity, CVSS 7.1. EPSS: 22.2% chance of exploitation in the next 30 days.

Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by creating an object inside an iframe, deleting the frame by setting its location.href to about:blank, then accessing a property of the object within the deleted frame, which triggers a NULL pointer dereference. NOTE: it was later reported that 7.0.6000.16473 and earlier are also affected.

Affected products

• Microsoft Internet Explorer: version 6.0 only

Published 2007-03-02. Last modified 2026-06-16.