Internet Explorer WebBrowser Control Attack Chain Turns Clicks Into RCE

Cybersecuritynews •Abinaya • June 8, 2026

Internet Explorer’s legacy WebBrowser control can still be abused to turn a single user click into full remote code execution (RCE) on Windows systems, even though the browser is officially retired. PT Security observed that by exploiting IE’s zone model, Mark of the Web (MOTW) handling, and powerful COM/ActiveX components, attackers can transform seemingly harmless […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Internet Explorer Control Vulnerability Enables RCE via User Clicks A vulnerability in Internet Explorer's legacy WebBrowser control allows attackers to exploit user clicks for remote code execution (RCE) on Windows systems. Despite the retirement of Internet Explorer, the Trident engine and WebBrowser ActiveX control are still embedded in various Windows applications. Attackers can leverage the zone model, Mark of the Web (MOTW) handling, and COM/ActiveX components to execute arbitrary code. This vulnerability affects systems that utilize applications relying on the legacy control, potentially impacting a wide range of users. The specific CVE associated with this vulnerability has not been disclosed, and no patches are currently available. Security researchers from PT Security have confirmed the exploitability of this issue. Organizations are advised to assess their systems for reliance on the affected components. The situation remains critical as exploitation could lead to severe breaches. 2 sources 66

Extracted Entities

Internet Explorer WebBrowser Control Attack Chain Turns Clicks Into RCE

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (2)