Maxthon International Maxthon3 Browser up to 3.2 cross site scripting

Summaryinfo

A vulnerability marked as problematic has been reported in Maxthon International Maxthon3 Browser up to 3.2. The impacted element is the function maxthon.program.Program.launch/maxthon.io.writeDataURL. The manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2012-10032. Remote exploitation of the attack is possible. Furthermore, an exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Maxthon International Maxthon3 Browser up to 3.2 and classified as problematic. This issue affects the function maxthon.program.Program.launch/maxthon.io.writeDataURL. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

Maxthon3 version 3.2.2 build 1000 and prior are vulnerable to cross context scripting (XCS) via the about:history page. The browser’s trusted zone improperly handles injected script content, allowing attackers to execute arbitrary JavaScript in a privileged context. This flaw enables modification of browser configuration and execution of arbitrary code through Maxthon’s exposed DOM APIs, including maxthon.program.Program.launch() and maxthon.io.writeDataURL(). Exploitation requires user interaction, typically by visiting a malicious webpage that triggers the injection.

The weakness was published by Roberto Suggi Liverani. It is possible to read the advisory at raw.githubusercontent.com. The identification of this vulnerability is CVE-2012-10032 since 08/05/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

Upgrading to version 3.3 eliminates this vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (23225) and EUVD (EUVD-2012-6576). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Maxthon International

Name

• Maxthon3 Browser

Version

• 3.0
• 3.1
• 3.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion