CVE-2009-2350: Microsoft Internet Explorer 6.0.2900.2180 and earlier does not block javascript: URIs in Refresh headers in...

Security readout for executives and security teams

This issue affects very old Microsoft Internet Explorer versions that may execute JavaScript placed in an HTTP Refresh header. If an attacker can influence that header, IE users could be exposed to cross-site scripting. The source bundle does not provide a CVSS score, patch details, or active exploitation evidence. Exposure is most likely in legacy environments still using IE 6-era browsers, especially where applications, redirects, proxies, or upstream systems can emit attacker-influenced Refresh headers. Treat this as a legacy-technology risk. It is not currently supported by active exploitation evidence in the bundle, but any remaining IE 6 dependency should be removed or isolated because browser XSS controls are obsolete. Mitigation focus: Check Microsoft and vendor guidance for historical fixes or compensating controls.; Remove IE 6-era browsers from supported desktop and kiosk environments.; Review applications for user-controlled Refresh response headers..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.