CVE-2007-6640: Creammonkey 0.9 through 1.1 and GreaseKit 1.2 through 1.3 does not properly prevent access to dangerous fun...

Security readout for executives and security teams

This is a browser userscript extension security bypass affecting Creammonkey 0.9 through 1.1 and GreaseKit 1.2 through 1.3. A malicious webpage could reach privileged userscript functions where a userscript is configured, potentially reading or changing configuration or causing HTTP requests. The sources do not provide CVSS, patch status, or active exploitation evidence. Exposure is likely limited to legacy browser environments using Creammonkey 0.9-1.1 or GreaseKit 1.2-1.3 with userscripts configured for visited pages. Modern managed endpoints are unlikely to have these obsolete extensions, but archived kiosks, research systems, or unmanaged browsers should be checked. This is not a broad enterprise emergency, but it is a real trust-boundary failure in obsolete browser tooling. Prioritize confirmation in legacy or unmanaged browser populations. If found, removal is usually the cleanest risk decision unless a documented business dependency exists. Mitigation focus: Inventory endpoints for Creammonkey and GreaseKit installations and versions.; Remove or disable affected extensions where business need is absent.; Check original vendor and advisory guidance for fixed or retired versions..

Prepared

Jun 28, 2026, 19:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.