CVE-2010-1762

Vulnerability

A cross-site scripting (XSS) vulnerability exists in WebKit, the rendering engine used by Apple Safari, when processing specially crafted HTML inside a TEXTAREA element. The issue affects Safari versions prior to 5.0 on Mac OS X 10.5 through 10.6 and Windows, as well as versions prior to 4.1 on Mac OS X 10.4 [2]. The vulnerability allows injected content to bypass expected context restrictions, enabling script execution in the browser's security context of the originating site.

Exploitation

An attacker only needs to deliver a crafted HTML page (e.g., via a malicious link, iframe, or compromised site) to a user running an affected Safari version. The attack requires no additional authentication or user interaction beyond visiting the malicious page. By placing carefully constructed content inside a TEXTAREA element, the attacker can break out of the textarea's plain-text context and inject arbitrary HTML or JavaScript [3].

Impact

Successful exploitation allows the attacker to execute arbitrary web script or HTML in the context of the victim's browser session on the target domain. This can lead to information disclosure (e.g., reading cookies or local storage), modification of page content, session hijacking, or further malicious actions within the site's security boundary [1][2][3].

Mitigation

Apple has released Safari 5.0 (for Mac OS X 10.5–10.6 and Windows) and Safari 4.1 (for Mac OS X 10.4) to address this vulnerability [2]. Users should update to the latest version of Safari for their operating system. No workarounds are documented in the available references. The issue is not listed on the KEV (Known Exploited Vulnerabilities) catalog as of the publication date.