Internet Explorer 7.0 is vulnerable to cross-site scripting in one of its local resources. In combination with a design flaw in this specific local resource it is possible for an attacker to easily conduct phishing attacks against IE7 users.
• Windows Vista – Internet Explorer 7.0
• Windows XP – Internet Explorer 7.0
Proof-of-Concept is available
Workaround / Suggestion
Until Microsoft fixes this vulnerability, do not trust the “Navigation Canceled” page.