A class of vulnerabilities in IE allows malicious script from one domain to
execute in a different domain which may also be in a different IE security
zone.

 

By convincing a victim to view an HTML document (web page, HTML email),
an attacker could execute script in a different security domain than the one
containing the attacker's document. By causing script to be run in the Local
Machine Zone, the attacker could execute arbitrary code with the privileges
of the user running IE.

 

Recent incident activity known as Download.Ject (also JS.Scob.Trojan, Scob,
JS.Toofeer) uses cross-domain vulnerabilities and the ADODB.Stream control
to install software that steals sensitive financial information