Microsoft Cracks Down on Internet Explorer Mode After New Wave of Hacks
Microsoft is tightening restrictions on Internet Explorer (IE) Mode in its Edge browser after hackers once again exploited vulnerabilities in the long-retired browser to compromise user devices.
Though Internet Explorer was officially discontinued and disabled in 2022, remnants of the browser remain embedded in Edge as “IE Mode,” a feature designed to support older websites that still rely on legacy web technologies. The decision to retain this compatibility function has now come back to haunt the company, with cybercriminals exploiting unpatched flaws in the IE engine to gain remote access to victims’ systems.
According to Microsoft, hackers are using simple social engineering tactics to trick users into enabling IE Mode. Victims are lured to fake websites posing as legitimate organisations, where they are prompted to reload the page in IE Mode. Once activated, attackers deploy a series of exploits targeting the Chakra JavaScript engine to execute malicious code and escalate privileges, ultimately seizing full control of the affected device.
The vulnerability allows hackers to bypass Edge’s security protections, install malware, spy on users, and extract sensitive data from compromised networks. Some of these campaigns have been linked to state-backed hacking groups, including actors from North Korea, who previously leveraged similar IE-based flaws to spread malware.
In response, Microsoft is rolling out new restrictions to limit how IE Mode can be accessed by non-commercial users. The company will remove several high-risk pathways for launching the feature, including the toolbar button, context menu options, and hamburger menu shortcuts. Going forward, users will need to manually enable IE Mode for specific websites through Edge’s settings, making activation a more deliberate and less exploitable process.
Microsoft said the changes aim to reduce “casual access” to IE Mode and make it harder for attackers to coerce users into triggering the outdated technology. However, these new controls are not a security patch, only an extra safeguard. Enterprise users relying on IE Mode for business applications will still be able to manage it via existing policy settings.
The tech giant is again urging users and organisations to move away from Internet Explorer altogether. Despite its legacy status, the browser remains a significant security risk, running outdated web technologies that can easily be manipulated by modern threat actors.
The latest development underscores an uncomfortable reality for Microsoft: even after its retirement, Internet Explorer continues to pose a danger in today’s cybersecurity landscape. The company’s challenge now lies in balancing backward compatibility with the need to close a decades-old security loophole that refuses to die.
Photo Credit: DepositPhotos.com