Microsoft: We'll fix Internet Explorer flaw

The flaw has been left up to third-party vendors by Microsoft rather than issuing a patch for Internet Explorer

Microsoft has taken the unusual step of taking responsibility for an Internet Explorer security loophole that it previously didn't want to fix. The vulnerability could be used to execute malicious code on an affected machine.

The corporation had previously shifted the focus to third-party apps when the vulnerability was reported back in July. As we reported at the time, the application in question was Firefox; Internet Explorer was used to execute malicious commands via Firefox. As Jonathan, from the Microsoft Security Response Center (MSRC) now says.

Microsoft didn't act upon the problem at the time and it was generally thought that Microsoft was just leaving it to third-party software vendors to make sure its apps didn't accept bad code, rather than prevent it getting through in the first place. "While we might have been able to make changes in some Windows APIs to block these attacks, doing so could break how the 3rd party applications [functioned], says MSRC.

URI handling code

The issue revolves around URI handling code. This is the instructions that mean you can click on an email address and IE will launch your email client with an open email.

Microsoft has now found further issues involving URI handling code - hence its change of tune. "One of the reasons we are releasing this Advisory is due to increased risk given recent discussions about how this vulnerability could be used in attacks," continued the MSRC.

"We want customers to know that we have been investigating the URI vulnerability covered in this advisory since it was publicly reported in July and will be issuing an update once development and testing is complete."


Dan (Twitter, Google+) is TechRadar's Former Deputy Editor and is now in charge at our sister site Covering all things computing, internet and mobile he's a seasoned regular at major tech shows such as CES, IFA and Mobile World Congress. Dan has also been a tech expert for many outlets including BBC Radio 4, 5Live and the World Service, The Sun and ITV News.