CVE-2006-3352

Cross-domain vulnerability in Mozilla Firefox allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object. NOTE: this description was based on a report that has since been retracted by the original authors. The authors misinterpreted their test results. Other third parties also disputed the original report. Therefore, this is not a vulnerability. It is being assigned a candidate number to provide a clear indication of its status

• http://isc.sans.org/diary.php?storyid=1448
• http://www.securityfocus.com/archive/1/438785/100/0/threaded
• http://www.securityfocus.com/archive/1/438788/100/0/threaded
• http://www.securityfocus.com/archive/1/438811/100/0/threaded
• http://www.securityfocus.com/archive/1/438863/100/0/threaded
• http://www.securityfocus.com/archive/1/438864/100/0/threaded
• http://www.securityfocus.com/archive/1/439146/100/0/threaded
• http://www.securityfocus.com/bid/18734
• http://isc.sans.org/diary.php?storyid=1448
• http://www.securityfocus.com/archive/1/438785/100/0/threaded
• http://www.securityfocus.com/archive/1/438788/100/0/threaded
• http://www.securityfocus.com/archive/1/438811/100/0/threaded
• http://www.securityfocus.com/archive/1/438863/100/0/threaded
• http://www.securityfocus.com/archive/1/438864/100/0/threaded
• http://www.securityfocus.com/archive/1/439146/100/0/threaded
• http://www.securityfocus.com/bid/18734

Published

Jul 6, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-3346SQL injection vulnerability in tree.php in MyNewsGroups 0.6 …
• CVE-2006-3347SQL injection vulnerability in index.php in deV!Lz Clanporta…
• CVE-2006-3348Multiple SQL injection vulnerabilities in HSPcomplete 3.2.2 …
• CVE-2006-3349Multiple SQL injection vulnerabilities in SmS Script allow r…
• CVE-2006-3350Stack-based buffer overflow in AutoVue SolidModel Profession…
• CVE-2006-3351Buffer overflow in Windows Explorer (explorer.exe) on Window…
• CVE-2006-3353Opera 9 allows remote attackers to cause a denial of service…
• CVE-2006-3354Microsoft Internet Explorer 6 allows remote attackers to cau…
• CVE-2006-3355Heap-based buffer overflow in httpdget.c in mpg123 before 0.…
• CVE-2006-3356The TIFFFetchAnyArray function in ImageIO in Apple OS X 10.4…
• CVE-2006-3357Heap-based buffer overflow in HTML Help ActiveX control (hhc…
• CVE-2006-3358Multiple cross-site scripting (XSS) vulnerabilities in index…