Hackers Exploit Microsoft Edge IE Mode for RCE and Sandbox Escape—Update Your Settings Now

Microsoft Edge's Internet Explorer (IE) compatibility mode, designed for legacy sites using ActiveX or Flash, has become a hacker hotspot. In August 2025, attackers exploited it with a zero-day in IE's Chakra JavaScript engine, bypassing modern Chromium safeguards. They tricked users into reloading spoofed sites in IE mode via deceptive prompts, achieving remote code execution (RCE) in the browser, then escaping the sandbox to gain SYSTEM privileges for malware installation, lateral movement, and data theft.


The flaw stems from IE's outdated architecture, lacking Edge's robust mitigations. Upon detecting active exploitation, Microsoft's Edge team disabled easy IE mode triggers—like toolbar buttons and menu options—for non-enterprise users, while preserving admin controls via group policy or Intune. Now, accessing IE mode requires deliberate setup: Go to Settings > Default Browser, enable "Allow sites to be reloaded in IE mode," add URLs to the list, and reload manually.


IE 11 ended support in 2022, so Microsoft urges migrating from legacy tech. Check your settings to disable or configure IE mode, and prioritize modern standards for security. This fix balances compatibility with protection, shrinking the attack surface against evolving threats.
NPAV offers a robust solution to combat cyber fraud. Protect yourself with our top-tier security product, Z Plus Security