Cross-zone scripting
There are four well known zones in Internet Explorer:


These zones are explained in detail by "How to use security zones in Internet Explorer". There is also an additional hidden zone:
Local intranet, Trusted sites and Local Computer are usually configured to be privileged zones. Most cross-zone scripting attacks are designed to jump from Internet zone to a privileged zone. This type of exploit attempts to execute code in the security context of Local Computer Zone. The following HTML is used to illustrate a naive (non-working) attempt of exploitation:
<syntaxhighlight lang="html">
<! DOCTYPE html>
<html>
<body>
<img src="attack.gif">
<script src="file://C:\Documents and Settings\Administrator\
 Local Settings\Temporary Internet Files\attack.gif">
</body>
</html>
</syntaxhighlight>
Explanation: the HTML code attempts to get attack.gif loaded into the cache by using an IMG SRC reference. Then a SCRIPT SRC tag is used to attempt executing the script from the Local Computer Zone by addressing the local file in cache. Consider this scenario:

A computer which considers intranet.example.com a part of "Local Intranet" zone will now successfully be cross zone scripted. A well-known example is the %2f bug in Internet Explorer 6. It was discovered that the following URL
executed with "Trusted Sites" permission if was listed as a trusted site.
Origins of the zone concept
* a cross-site scripting vulnerability within a privileged zone
A common attack scenario involves two steps. The first step is to use a cross-zone scripting vulnerability to get scripts executed within a privileged zone.