Google Toolbar vulnerabilities

5 CVEs affecting Google Toolbar, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2007-6536, published 2007-12-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2002-1444, published 2002-08-15. Low severity, CVSS 2.6. EPSS: 13.5% chance of exploitation in the next 30 days. The Google toolbar 1.1.60, when running on Internet Explorer 5.5 and 6.0, allows remote attackers to cause a denial of service (crash with an exception in oleaut32.dll) via malicious HTML, possibly…
CVE-2004-2475, published 2004-12-31. Medium severity, CVSS 4.3. EPSS: 3% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Google Toolbar 2.0.114.1 allows remote attackers to inject arbitrary web script via about.html in the About section. NOTE: some followup posts suggest…
CVE-2002-1442, published 2003-04-11. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. The Google toolbar 1.1.58 and earlier allows remote web sites to perform unauthorized toolbar operations including script execution and file reading in other zones such as "My Computer" by opening a…
CVE-2002-1443, published 2003-04-11. Medium severity, CVSS 5.0. EPSS: 1.3% chance of exploitation in the next 30 days. The Google toolbar 1.1.58 and earlier allows remote web sites to monitor a user's input into the toolbar via an "onkeydown" event handler.
CVE-2007-6536, published 2007-12-27. Medium severity, CVSS 6.8. EPSS: 1.3% chance of exploitation in the next 30 days. The Custom Button Installer dialog in Google Toolbar 4 and 5 beta presents certain domain names in the (1) "Downloaded from" and (2) "Privacy considerations" sections without verifying domain names,…