CVE-2009-2064: Microsoft Internet Explorer

Medium severity, CVSS 6.8. EPSS: 4.3% chance of exploitation in the next 30 days.

Microsoft Internet Explorer 8, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."

Affected products

• Microsoft Internet Explorer: up to and including 8; version 5 only; version 5.01 only; version 6 only; version 7 only; version 7.0.5730 only; …
• Microsoft Pocket Ie: version 1.0 only; version 1.1 only; version 2.0 only; version 3.0 only; version 4.0 only; version 2002 only; …

Published 2009-06-15. Last modified 2026-06-16.