Microsoft MSHTML Framework Security Feature Bypass

CVE-2026-21513 is a high-severity security feature bypass vulnerability in the Microsoft MSHTML Framework / Internet Explorer rendering engine. Microsoft describes it as a protection mechanism failure that allows an unauthorized attacker to bypass a security feature over a network. Supporting reporting indicates the vulnerable logic is in MSHTML hyperlink navigation handling within ieframe.dll, where insufficient validation of a target URL can allow attacker-controlled input to reach ShellExecuteExW and cause local or remote resources to be executed outside the intended browser security context. In observed exploitation, attackers used crafted HTML content and malicious Windows Shortcut (.lnk) files, including LNK files with embedded HTML payloads, to manipulate browser and Windows Shell handling, bypass execution prompts and trust boundaries such as Mark-of-the-Web and Internet Explorer Enhanced Security Configuration. Microsoft and third-party reporting state the flaw was exploited as a zero-day in the wild, including in campaigns attributed to APT28/Fancy Bear targeting Ukraine and EU member states beginning in late 2025.