CVE-2008-2306: Apple Safari

High severity, CVSS 9.3. EPSS: 3.8% chance of exploitation in the next 30 days.

Apple Safari before 3.1.2 on Windows does not properly interpret the URLACTION_SHELL_EXECUTE_HIGHRISK Internet Explorer zone setting, which allows remote attackers to bypass intended access restrictions, and force a client system to download and execute arbitrary files.

Affected products

• Apple Safari: up to and including 3.1.1; version 3.0 only; version 3.0.1 only; version 3.0.2 only; version 3.0.3 only; version 3.0.4 only; …

Published 2008-06-23. Last modified 2026-06-16.