Microsoft has taken immediate action to tighten the security of Internet Explorer (IE) mode in its Edge browser after discovering a sophisticated zero-day exploit that allowed cybercriminals to exploit this legacy feature and compromise users’ devices.
According to the Microsoft Browser Vulnerability Research team, attackers targeted an unpatched vulnerability in Internet Explorer’s JavaScript engine (Chakra), a legacy component still present in IE mode on Microsoft Edge. The attackers used a combination of social engineering and technical exploits to trick victims into visiting a legitimate-looking website, which prompted them to reload the page in IE mode. Once in IE mode, the attackers leveraged the Chakra exploit to execute remote code (RCE), enabling them to escalate privileges and gain full control of the affected systems.
This attack was especially concerning as it successfully bypassed the advanced security measures inherent in Chromium-based Edge. By forcing the browser to run in its less secure Internet Explorer mode, attackers were able to execute malicious code, install malware, and move laterally across networks. The exploit also allowed them to access sensitive data, posing significant risks to both individual users and organizations.
Microsoft’s Response: Stricter IE Mode Controls
Following credible reports of the exploit’s active use in August 2025, Microsoft acted swiftly to mitigate future risks. The company has removed several quick-access options that previously made it easy for users to trigger IE mode. These included the toolbar shortcut, right-click context menu entry, and hamburger menu option. These features have now been eliminated from Microsoft Edge.
To enable IE mode moving forward, users will now need to manually activate it through Edge’s settings. The steps are as follows:
- Navigate to Settings > Default Browser.
- Turn on the option labeled “Allow sites to be reloaded in Internet Explorer mode”.
- Add trusted sites to the list of pages that can be reloaded in IE mode.
- Reload the page.
This approach forces users to make a deliberate decision when using legacy web technology, ensuring a more intentional use of IE mode. Microsoft explained that these changes are intended to balance the need to support legacy web apps while also strengthening the security of the Edge browser. The company also stated that this extra step of adding trusted sites to the list acts as a significant barrier, preventing attackers from easily exploiting IE mode in the future.
“The additional steps required to add a site to a site list are a significant barrier for even the most determined attackers,” Microsoft stated in a recent release.
Ongoing Risks of Legacy Technology
This exploit highlights an ongoing challenge in the tech world: the risks of maintaining compatibility with legacy systems in an increasingly secure and modern digital environment. Legacy browser compatibility features, while essential for many organizations relying on outdated web technologies, have become prime targets for cybercriminals. As cybersecurity threats evolve and become more sophisticated, older systems and features like IE mode increasingly serve as vulnerable entry points for attackers.
As part of its broader strategy to enhance cybersecurity, Microsoft is encouraging businesses and users to migrate away from outdated web applications and protocols that rely on legacy browser technologies. The new restrictions on IE mode give organizations more time to transition while reducing the potential for attacks exploiting outdated features.
