HighPublic exploit

Cross-Context Scripting in Maxthon3 about:history

IdentifiersCVE-2012-10032CWE-79· Improper Neutralization of Input…

CVE-2012-10032 is a cross-context scripting (XCS) vulnerability in Maxthon3 prior to version 3.3. The issue affects the browser's about:history page, where script content can be injected and then executed within a trusted or privileged browser context. Because the trusted zone improperly handles the injected content, arbitrary JavaScript can run with elevated browser privileges rather than normal web-origin restrictions. The exposed privileged DOM APIs available in that context include functions such as maxthon.program.Program.launch() and maxthon.io.writeDataURL(), which can be abused to launch programs and write attacker-controlled data. As a result, a malicious webpage can trigger script execution in the privileged context after user interaction.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an attacker to execute arbitrary JavaScript in a privileged browser context, bypassing normal web security boundaries. This can enable modification of browser configuration and abuse of privileged Maxthon DOM APIs to perform actions outside the scope of ordinary web content. Based on the described exposed APIs, impact can include launching local programs and writing attacker-controlled content, which may lead to arbitrary code execution on the host system.

Mitigation

If you can’t patch tonight, do this now.

Until an upgrade is applied, avoid using affected Maxthon3 versions to browse untrusted websites. Limit exposure by disabling or restricting access to privileged browser features where possible, reducing use of internal pages such as about:history during active browsing sessions, and applying endpoint controls that prevent unauthorized child-process execution or suspicious file writes initiated by the browser. User awareness is also relevant because exploitation requires visiting a malicious webpage.

Remediation

Patch, then assume compromise.

Upgrade Maxthon3 to version 3.3 or later, as versions prior to 3.3 are affected. Ensure the browser no longer permits script injected via about:history to execute in a trusted or privileged context, and remove or harden access from web-reachable contexts to privileged DOM APIs such as program launch and file/data writing interfaces.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

maxthon_history_xcs.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module targeting a Cross Context Scripting (XCS) vulnerability in the Maxthon 3 browser's about:history page (CVE-2012-10032). The exploit leverages the trusted zone of the browser to inject JavaScript, which in turn writes and executes an attacker-supplied payload (EXE) on the victim's Windows system. The module sets up a malicious HTTP server that serves different JavaScript payloads depending on the request URI. The attack is triggered when a victim using a vulnerable version of Maxthon 3 visits the attacker's server. The exploit is operational, as it delivers and executes a real payload, but is limited to specific Maxthon 3 versions due to changes in the browser's API in later releases. The code is structured as a standard Metasploit module, with the main logic in the 'on_request_uri' method, and uses both Ruby (for the module) and JavaScript (for the browser payload).

Disclosed Nov 26, 2012rubyjavascriptbrowsernetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Icu-ProjectInternational Components For Unicodeapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

5 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5