Fast Facts

• In August 2025, Microsoft detected hackers abusing Edge’s Internet Explorer (IE) mode to hijack devices.
• The attack relied on social engineering and unpatched vulnerabilities in IE’s old Chakra JavaScript engine.
• Microsoft has now removed easy IE mode access, forcing users to enable it manually for specific sites.
• IE mode exists to support legacy business web apps, but also reopens outdated security holes.
• Microsoft did not disclose the specific vulnerabilities or the hacker group involved.

The Ghost in the Machine: IE’s Lingering Shadow

Imagine a shiny new skyscraper, but with an old, creaky service elevator hidden in the basement-meant for rare use, yet still connected to every floor. For Microsoft Edge users, that elevator was Internet Explorer mode: a relic from the browser’s past, kept alive to support legacy web apps but largely forgotten by the modern world. In August 2025, cybercriminals found the key, pried open the doors, and went for a ride straight into users’ systems.

Microsoft’s recent disclosure reads like a familiar thriller: hackers lured victims to seemingly safe websites, then used subtle prompts-a flyout box nudging users to reload the page in IE mode. Once inside, attackers unleashed a zero-day exploit in the ancient Chakra JavaScript engine, gaining remote control and ultimately breaking out of the browser’s security sandbox. The result? Full device takeover, with the ability to deploy malware, steal data, and move laterally across networks.

History Repeats: Old Code, New Crimes

This isn’t the first time legacy tech has haunted modern systems. Internet Explorer, once the undisputed king of browsers, has been officially retired-but its ghost lingers in the form of IE mode, designed to help businesses still chained to outdated internal sites. Criminals have long exploited such backwards-compatibility features: in 2021, the “ProxyLogon” attacks famously targeted legacy components in Microsoft Exchange, and similar exploits have been seen in Java and Flash.

The common thread: when old code is propped up for convenience, it can become an open window for attackers. Security researchers have repeatedly warned that supporting legacy features is a double-edged sword, especially when they bypass the robust defenses built into modern browsers like Edge or Chrome.

Microsoft’s Response: Raising the Drawbridge

In response to the breach, Microsoft has slammed shut the easy-access routes to IE mode. Gone are the toolbar button, right-click menu, and hamburger menu options. Now, only users who deliberately enable the feature in Edge’s settings-and specify precisely which sites need it-can access IE mode. Microsoft’s hope is that these extra steps create enough friction to deter attackers, while still offering a lifeline to businesses unable to let go of the past.

While the company remains tight-lipped about the vulnerabilities and perpetrators, the message is clear: the cost of legacy support is growing, and the window for attackers is closing. For organizations, it’s a wake-up call to finally retire those last, lingering web apps that demand Internet Explorer.

WIKICROOK

• Internet Explorer (IE) Mode: IE Mode in Microsoft Edge lets users view websites as if using Internet Explorer, mainly to support legacy web applications and sites.
• Chakra Engine: Chakra Engine was Microsoft’s JavaScript engine for Internet Explorer, now outdated and less secure compared to modern browser engines.
• Zero: A zero-day vulnerability is a hidden security flaw unknown to the software maker, with no fix available, making it highly valuable and dangerous to attackers.
• Social Engineering: Social engineering is the use of deception by hackers to trick people into revealing confidential information or providing unauthorized system access.
• Privilege Escalation: Privilege escalation occurs when an attacker gains higher-level access, moving from a regular user account to administrator privileges on a system or network.