Medium 4.3Published Jan 24, 2007

CVE-2007-0478WebCore on Apple Mac OS X 10.3.9 and 10.4.10, as used in Safari, does not properly parse HTML comments in TITLE elements, which allows remote attackers to conduct cross-site scripting (XSS) attacks a…

Updated under an hour ago (Nov 2, 2026, 2:40 AM ET)

Does this affect you?

It affects apple safari and 1 other product. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 1.71%, higher than 77% of scored CVEs.

Do this next

Start free and add your stackFree account, 3 products Every CVE for apple safari Exploited in the last 30 days

WebCore on Apple Mac OS X 10.3.9 and 10.4.10, as used in Safari, does not properly parse HTML comments in TITLE elements, which allows remote attackers to conduct cross-site scripting (XSS) attacks and bypass some XSS protection schemes by embedding certain HTML tags within an HTML comment.

CVSS: 4.3 MEDIUM (v2.0, NVD)AV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness (CWE): CWE-79
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 1.71% (percentile 77)
Assigned by: Not given
NVD analysis: Modified
Record last updated: Jun 16, 2026
First seen by InfoSec Signals: Nov 1, 2026

Affected products

Affected products

apple safari apple:safari	all versions	NVD
apple webcore apple:webcore	all versions	NVD

References

References

http://docs.info.apple.com/article.html?artnum=306172
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
http://osvdb.org/32712
http://secunia.com/advisories/23893	vendor-advisory
http://secunia.com/advisories/26235	vendor-advisory
http://securitytracker.com/id?1018494
http://www.beanfuzz.com/wordpress/?p=99
http://www.securityfocus.com/archive/1/457763/100/0/threaded
http://www.securityfocus.com/bid/25159
http://www.vupen.com/english/advisories/2007/2732
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.