Internet research firm Netcraft said it has detected a cross-site scripting vulnerability on Yahoo that could be used to hijack authentication cookies.