Hackers Exploit Microsoft Edge’s Internet Explorer Mode to Compromise User Devices

News site brief: Hackers exploited Microsoft Edge’s Internet Explorer mode to target users, with attacks that began by luring victims to a spoofed site and prompting them to reload in IE mode, effectively handing control to Chakra, Microsoft’s JavaScript engine.

The attackers then deployed an undisclosed zero-day against Chakra to achieve remote code execution within the browser process, followed by a second exploit to escape the sandbox and escalate to SYSTEM level, enabling malware installation, lateral movement, and data exfiltration while masking the activity as legitimate access to a legacy site.

In response, the Edge security team verified exploitation attempts and removed the most accessible IE mode triggers, disabling the toolbar button, context menu option, and the reload-in-IE mode entries for non-commercial users, while enterprise policy controls remained available via group policy or Microsoft Intune. Microsoft Edge had previously described IE mode as a bridge for legacy applications, allowing organisations to designate specific domains to open in IE mode and then return to Edge’s secure environment.

Internet Explorer 11 reached its end of life on 15 June 2022, and Microsoft advises migrating away from legacy technologies where possible.