Microsoft: Exploit Published for Windows Flaw
Summary: Microsoft warned that hackers published instructions for attacking a previously unknown hole in all versions of Windows, a flaw in how Windows handles MHTML code that could let attackers run JavaScript if a user browses a malicious site in Internet Explorer. Qualys CTO Wolfgang Kandek noted that IE is the only known exploit vehicle, since Firefox and Chrome are unaffected in their default configuration because they don't support MHTML without specific add-ons, and Microsoft said it may issue a patch while offering a FixIt tool in the meantime.
What's compelling: The stopgap itself carries risk: commenters noted the FixIt is an MSI served over http from download.microsoft.com, and that the UnFixIt removes all restricted protocols rather than just the MHTML keys, so the workaround can be spoofed or overreach before a real patch exists.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026