Internet Explorer WebBrowser Control Attack Chain Turns Clicks Into RCE

Internet Explorer’s legacy WebBrowser control can still be abused to turn a single user click into full remote code execution (RCE) on Windows systems, even though the browser is officially retired. PT Security observed that by exploiting IE’s zone model, Mark of the Web (MOTW) handling, and powerful COM/ActiveX components, attackers can...

Read the full article at the source.