Microsoft revamps Internet Explorer Mode in Edge after August attacks

Microsoft updated Edge’s Internet Explorer mode after reports in August 2025 that threat actors exploited the feature to gain unauthorised access to users’ devices. Edge’s IE mode lets organisations run legacy Internet Explorer 11 sites and apps within a modern browser, simplifying access to old and new web applications.

In August 2025, attackers exploited IE mode using social engineering and unpatched IE Chakra vulnerabilities, and Microsoft did not disclose technical details about the attacks or the identity of the threat actors behind them. They tricked users into reloading pages in IE mode, gaining remote code execution, escalating privileges, and potentially installing malware, moving laterally, or stealing sensitive data.

According to Microsoft, the advisory notes that the attackers used a spoofed website and a page flyout to prompt a reload in IE mode, followed by Chakra exploits to breach the device. To mitigate the issue, Edge removed easy-access buttons for non-commercial users, and IE mode now requires explicit site-by-site enabling via Settings > Default Browser.