Hello fellow bug hunter! Today we are going back to Internet Explorer which despite getting old, tons people still use it. I am much happier with
MSRC lately, they are really moving forward regarding Edge, design bugs, and they even extended its
bug bounty, which seems to be permanent now.
All those are good news, but I still believe it is not acceptable to leave IE wide open. For example, right now all IE users can be turned into bots with the
zombie script bug (which has been public and unpatched for months). If you don’t think it’s important, then imagine what black hats can do right now:
they can stay in your browser even if you navigate to a different site, which gives them plenty of time to do ugly stuff like
mining digital currencies while abusing of users CPUs. Also, IE has its
popUp blocker is completely broken and nobody seem to care. Fine, but I think these things should be patched or at least set a big red warning to IE users when they open it, something like “We do not support this browser anymore, use Microsoft Edge“.
In my opinion, Microsoft is trying to get rid of IE without saying it. It would be easier, more honest to simply tell users that their older browser is not being serviced like Edge. Current browser stats, according to
Netmarketshare show that IE is still more popular than Edge: 17% vs 6%.
I firmly believe that IE should be treated like Edge in terms of security, otherwise get rid of it completely. Either way, let’s explore another bug on IE that allows attackers to know the address where the user is going. Mind reading? Nope, we know mind reading does not exist, but take a look and see how IE allows us attackers to do what appears to be magic...
Quote