Loading story…
Microsoft Edge's Internet Explorer (IE) Mode was exploited by a mysterious threat actor who leveraged a zero-day vulnerability in the legacy Chakra JavaScript engine to gain unauthorized access to user devices. The attacks, which began at least as early as August 2025, involved social engineering tactics where users were tricked into reloading seemingly legitimate websites in IE Mode. This mode, designed to provide backward compatibility for older web applications, runs web pages using the outdated Internet Explorer engine within Edge. Attackers created clones of legitimate sites and used on-page prompts to convince users to activate IE Mode, thereby exposing them to the vulnerable Chakra engine. The exploit chain consisted of a zero-day vulnerability that enabled remote code execution, followed by a privilege escalation exploit that allowed attackers to take full control of the affected system. Microsoft did not release a CVE or a specific patch for the vulnerabilities but instead responded by overhauling the IE Mode feature. The company removed all dedicated buttons, context menu options, and menu items that allowed easy access to IE Mode, making it significantly harder for users to inadvertently activate the feature. Now, users must manually enable IE Mode through the browser's settings, adding a layer of friction and reducing the attack surface. The attacks were particularly concerning because they bypassed modern security protections in Chromium-based Edge by reverting to the less secure Internet Explorer environment. Microsoft has not disclosed the identity of the threat actor, the full scope of the attacks, or the technical details of the exploited vulnerabilities. The company’s response underscores the ongoing risks associated with maintaining legacy compatibility features in modern browsers. Security experts have highlighted that such backward compatibility can inadvertently introduce significant vulnerabilities, especially when legacy code is no longer actively maintained. The incident demonstrates the importance of minimizing legacy feature exposure and the need for organizations to review their reliance on outdated web technologies. Microsoft’s swift action to restrict access to IE Mode is intended to prevent further exploitation while a more permanent solution is considered. The event has raised awareness among enterprise users and IT administrators about the dangers of enabling legacy browser modes. Organizations are advised to audit their use of IE Mode and consider alternatives to legacy web applications. The attack chain also illustrates the effectiveness of combining social engineering with technical exploits to compromise even modern browser environments. This incident serves as a cautionary tale for software vendors about the security trade-offs involved in supporting legacy features.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
By October 2025, Microsoft changed Edge's IE Mode to reduce abuse, removing easy-access buttons and requiring users to manually enable and configure the legacy feature. Multiple reports describe this as a lockdown or patching response to the zero-day attacks.
In August 2025, a threat actor began exploiting Microsoft Edge's Internet Explorer Mode to execute malicious code and take over devices. The attacks reportedly chained a zero-day in the Chakra JavaScript engine with a privilege escalation exploit.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcenews.risky.biz
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft Edge users faced a series of serious vulnerabilities spanning remote code execution, information disclosure, and legacy browser compatibility risks. Reported issues included `CVE-2025-59251`, an Edge remote code execution flaw with limited public technical detail; `CVE-2025-29834`, an out-of-bounds read in the V8 JavaScript engine affecting versions before `135.0.2789.91`; and `CVE-2025-49713`, a type confusion bug in V8 that reportedly enabled in-the-wild exploitation against Edge versions before `138.0.3351.65`. Separately, `CVE-2025-49741` was described as an information disclosure issue tied to improper validation of the `x-middleware-subrequest` HTTP header, potentially exposing cached data and session tokens in versions before `137.0.3296.62`. The disclosures also highlighted risk beyond standard browsing sessions. `CVE-2025-30397` affected Microsoft’s Scripting Engine when Edge was used in Internet Explorer Mode, creating an actively exploited path to remote code execution on Windows 10 and Windows 11 systems that still depend on legacy web applications. Microsoft issued updates across the affected products, while defenders were urged to prioritize browser patching, review exposure in Chromium-based deployments, harden JavaScript and web-content controls, and reduce or disable IE Mode where operationally possible. A new advisory from HKCERT on multiple Microsoft Edge vulnerabilities underscores the continuing volume of security issues affecting the browser.
Jun 29, 2026
Microsoft released fixes for **CVE-2020-0674**, a memory corruption flaw in the Internet Explorer scripting engine that could let an attacker execute arbitrary code in the context of the current user. The company said the vulnerability had been **publicly disclosed and exploited in the wild**, and warned that systems where users hold administrative privileges could be fully compromised. Microsoft also published mitigations and a workaround that restricts access to `JScript.dll`, noting that **IE11, IE10, and IE9** typically use `Jscript9.dll`, which is not affected, and that exposure is tied to sites invoking the legacy JScript engine. Microsoft’s related guidance on **Internet Explorer Enhanced Security Configuration (IE ESC)** highlights defensive measures for Windows Server environments that reduce exposure to web-based attacks. IE ESC hardens browser security zones, restricts scripting, ActiveX, downloads, and third-party extensions, and reinforces Microsoft’s recommendation to minimize web browsing from servers and tightly control trusted and intranet site assignments. The guidance also warns that incorrectly adding Internet sites to the Local intranet zone can automatically send user credentials, increasing risk during browser-based exploitation attempts.
Aug 15, 2026
A company continues to use Internet Explorer Mode (IE Mode) within Microsoft Edge for legacy workflows, raising concerns about security vulnerabilities. IE Mode leverages the outdated MSHTML engine, which is known for its exploitable flaws. The use of Group Policy to enforce IE Mode prevents employees from disabling it, increasing organizational risk.
Jun 29, 2026