Another Way to Ditch IE6

Summary: Security researcher Alex Holden demonstrated a short string, ms-its:%F0:, that crashes Internet Explorer 6 through a pointer overflow in the browser, and the crash does not appear to work in newer IE versions. Holden said he notified Microsoft of the finding in 2004, and an email thread indicates Microsoft engineers believed there were no severe security consequences and that it would probably be fixed in a future service pack, which it never was.
Why it matters: The crash string can be delivered to a targeted XP user through a link in an instant message or email, and a worm could use it to swap a victim's home page to the code and cut off their IE6 access to the web. A commenter also reports a hospital system running IE6 on all PCs used to access financial and medical records of its 3.3 million patients.

Read the original at Krebs on Security ↗

Topics: Data Breaches
Related: TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026
Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026
City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026