Microsoft Locks Down IE Mode After Hackers Turned Legacy Feature Into Backdoor

Microsoft has revamped Edge’s Internet Explorer mode after credible reports in August 2025 that unknown threat actors were abusing the feature to access victim devices. According to Microsoft Browser Vulnerability Research team, threat actors were leveraging social engineering alongside unpatched (0-day) exploits in Internet Explorer’s Chakra JavaScript engine to gain remote access.

The attackers are described as using a flyout to instruct users to reload a page in IE mode, with later steps allegedly weaponising an unspecified Chakra exploit to achieve remote code execution and privilege escalation. In response, Microsoft removed the dedicated IE mode toolbar button, context menu, and hamburger menu items to curb exploitation, and users wishing to use IE mode must enable it case-by-case via Edge settings.

Specifically, users should go to Settings > Default Browser, set Allow sites to be reloaded in Internet Explorer mode to Allow, and then add the required sites to the Internet Explorer mode pages list before reloading.