CVE-2017-0140

MediumCVSS 4.2/10Last modified Jun 17, 2026

Description

Microsoft Edge allows remote attackers to bypass the Same Origin Policy for HTML elements in other browser windows, aka "Microsoft Edge Security Feature Bypass Vulnerability." This vulnerability is different from those described in CVE-2017-0066 and CVE-2017-0135.

Metrics

CVSS 3.0 4.2/10CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Mar 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-01417.5A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro CVE-2017-01438.8The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an CVE-2017-01448.8The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an CVE-2017-01458.8The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an CVE-2017-01468.8The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an CVE-2017-01477.5The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an CVE-2017-01488.1The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an CVE-2017-01498.8Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v CVE-2017-01507.5A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro CVE-2017-01517.5A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Micro CVE-2017-01528.1A remote code execution vulnerability exists in the way affected Microsoft scripting engine render when handling objects in memory in Micros CVE-2017-01544.4Microsoft Internet Explorer 11 on Windows 10, 1511, and 1606 and Windows Server 2016 does not enforce cross-domain policies, allowing attack