Internet Explorer Control Vulnerability Enables RCE via User Clicks

A vulnerability in Internet Explorer's legacy WebBrowser control allows attackers to exploit user clicks for remote code execution (RCE) on Windows systems. Despite the retirement of Internet Explorer, the Trident engine and WebBrowser ActiveX control are still embedded in various Windows applications. Attackers can leverage the zone model, Mark of the Web (MOTW) handling, and COM/ActiveX components to execute arbitrary code. This vulnerability affects systems that utilize applications relying on the legacy control, potentially impacting a wide range of users. The specific CVE associated with this vulnerability has not been disclosed, and no patches are currently available. Security researchers from PT Security have confirmed the exploitability of this issue. Organizations are advised to assess their systems for reliance on the affected components. The situation remains critical as exploitation could lead to severe breaches.

Key Points: • Legacy WebBrowser control in Internet Explorer can be exploited for RCE. • Attackers can turn user clicks into remote code execution via COM/ActiveX components. • No patches are currently available, increasing the urgency for organizations to assess their systems.