{"id":21030,"date":"2023-05-05T15:03:05","date_gmt":"2023-05-05T11:03:05","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/internet-explorer-is-finally-dead-or-is-it\/21030\/"},"modified":"2023-05-05T15:03:05","modified_gmt":"2023-05-05T11:03:05","slug":"internet-explorer-is-finally-dead-or-is-it","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/internet-explorer-is-finally-dead-or-is-it\/21030\/","title":{"rendered":"Internet Explorer is finally dead. Or is it?"},"content":{"rendered":"<p>Not so long ago, the IT-security media space was once again full of cheery reports that Microsoft was finally <a href=\"https:\/\/www.cnet.com\/tech\/services-and-software\/rip-internet-explorer-microsoft-kills-off-legacy-browser\/\" target=\"_blank\" rel=\"nofollow noopener\">burying Internet Explorer (IE)<\/a>. Let\u2019s recap the long story of how the once most-popular browser in the world was gradually disconnected from its life-support systems, and investigate whether it\u2019s finally time to rejoice (spoiler: it isn\u2019t).<\/p>\n<h2> Internet Explorer: life <s>and death<\/s> chronicles<\/h2>\n<p>We remind those who didn\u2019t witness (or have forgotten) the 2000s that, back then, Internet Explorer ruled the web, with <a href=\"https:\/\/en.wikipedia.org\/wiki\/Usage_share_of_web_browsers\" target=\"_blank\" rel=\"nofollow noopener\">a browser market share of more than 90%<\/a>. It\u2019s hard to believe it now, but Explorer was even more dominant than the current champion, Google Chrome, is now.<\/p>\n<p>However, since the introduction of Chrome in 2008, Explorer\u2019s popularity has been steadily falling away. We can consider 2012 as the end of the Explorer era, when Chrome finally overtook it. That said, Microsoft\u2019s first official acknowledgment of this fact came only in 2015.<\/p>\n<p>Back then, along with unveiling Windows 10, the company announced it was closing down Internet Explorer\u2019s development and introducing <a href=\"https:\/\/www.theverge.com\/2015\/7\/29\/9066255\/microsoft-windows-edge-browser-review\" target=\"_blank\" rel=\"nofollow noopener\">Edge<\/a> as the default browser for Windows, signifying the first phase of IE\u2019s decommissioning. The original version of Edge was powered by Microsoft\u2019s own EdgeHTML engine, a modification of the MSHTML (also known as Trident), on which Internet Explorer was based.<\/p>\n<p>Of course, Edge featured an IE compatibility mode. However, Explorer, in its eleventh and final version, was still integrated into the operating system. So began the dual-browser period, when both Edge and Explorer were preinstalled in Windows, which (another spoiler) continues to this day.<\/p>\n<p>Three years later, in December 2018, came phase two: Microsoft abandoned further attempts to develop its own engine and <a href=\"https:\/\/www.theverge.com\/2018\/12\/6\/18128648\/microsoft-edge-chrome-chromium-browser-changes\" target=\"_blank\" rel=\"nofollow noopener\">unveiled<\/a> an all-new version of Edge, this time based on <a href=\"https:\/\/en.wikipedia.org\/wiki\/Chromium_(web_browser)\" target=\"_blank\" rel=\"nofollow noopener\">Chromium<\/a>. This browser, too, had an IE compatibility mode. And Explorer was still left in the system.<\/p>\n<p>In 2021, Microsoft released its new Windows 11. It was now no longer possible to boot up and use Explorer as a standalone browser \u2014 theoretically at least. However, Edge still retained its IE compatibility mode. And Explorer itself was still present in the system, so, after a spot of tinkering, it was still possible to <a href=\"https:\/\/www.theverge.com\/tldr\/2022\/8\/3\/23290171\/how-to-use-internet-explorer-windows-11-why-microsoft-why\" target=\"_blank\" rel=\"nofollow noopener\">run it<\/a>.<\/p>\n<p>A couple of years after that, just recently in February 2023, news broke that Microsoft had finally finished off Explorer in its latest update. A coup de grace, ending this cruel agony. But, upon closer inspection, it turns out that the old dog is still breathing!\u2026<\/p>\n<h2>Disable doesn\u2019t mean delete<\/h2>\n<p>The first thing to realize about the Windows update is that it doesn\u2019t expunge Explorer from the operating system; it <em>disables it<\/em>. In practice, this means that Explorer can no longer be launched as a standalone browser (this time for sure). However, Edge, formally the only browser in Windows, still has an IE-compatible mode. This means that Explorer is still alive \u2014 if not quite kicking: it\u2019s there just to ensure the operation of this mode.<\/p>\n<p>Now if you try to open Explorer, Edge will run instead. And in it, if you really want to, you can select IE compatibility mode. Consequently, Explorer will continue to inhabit Windows until Microsoft finally decides to bury IE compatibility mode.<\/p>\n<h2>The patch to disable IE doesn\u2019t work on all systems<\/h2>\n<p>Even the <em>disabling<\/em> of Explorer wasn\u2019t absolute. There\u2019s a whole raft of operating systems excluded from getting the update that turns IE off. Microsoft has kindly <a href=\"https:\/\/techcommunity.microsoft.com\/t5\/windows-it-pro-blog\/internet-explorer-11-desktop-app-retirement-faq\/ba-p\/2366549\" target=\"_blank\" rel=\"nofollow noopener\">published<\/a> a list of these exclusions:<\/p>\n<ul>\n<li>Windows 8.1<\/li>\n<li>Windows 7 Extended Security Updates (ESU)<\/li>\n<li>Windows Server Semi-Annual Channel (SAC), all versions<\/li>\n<li>Windows 10 IoT Long-Term Servicing Channel (LTSC), all versions<\/li>\n<li>Windows Server LTSC, all versions<\/li>\n<li>Windows 10 client LTSC, all versions<\/li>\n<li>Windows 10 China Government Edition<\/li>\n<\/ul>\n<p>In other words, users of these operating systems haven\u2019t received even above mentioned changes. <strong>They will still be able to run Internet Explorer as a standalone browser.<\/strong><\/p>\n<h2>What\u2019s the problem anyway?<\/h2>\n<p>The problem is that along with the hopelessly obsolete browser all its vulnerabilities (plus yet-undiscovered ones) will remain in the system. The only real difference between \u201cbefore\u201d and \u201cafter\u201d IE disabling is that it might become a bit harder to exploit this vulnerable browser in certain types of attacks.<\/p>\n<p>As a vivid illustration of what can go wrong, we can recall the vulnerability <a href=\"https:\/\/www.kaspersky.com\/blog\/cve-2021-40444-vulnerability-mshtml\/41728\/\" target=\"_blank\" rel=\"noopener nofollow\">CVE-2021-40444<\/a>. It was discovered in the MSHTML engine of Internet Explorer in 2021. What\u2019s more, at the time of discovery, the vulnerability was already being exploited in attacks on Microsoft Office users. The attackers complemented Office documents with a malicious ActiveX element, which allowed remote code execution after the user opened the trojanized file.<\/p>\n<p>Why doesn\u2019t Microsoft just bury Explorer <strong>for good<\/strong>? The issue is that this browser was for too long the only viable option for many companies, during which time it managed to spread deep roots in their infrastructure. Some of those companies are still unable to part with the legacy of this dark past. So, for the sake of compatibility (a sacred cow for Microsoft), the half-dead browser has been dragged from OS to OS for over a decade now.<\/p>\n<h2>How to stay protected<\/h2>\n<p>By the looks of it, we\u2019ll likely be waiting at least a few more years before Internet Explorer is finally put out of its misery completely. Therefore, unless you want to wait for MS to finally kill off IE once and for all, (which we strongly advise against), it\u2019s better to administer the last rites yourself:<\/p>\n<ul>\n<li>If your company is still using technologies tied to Internet Explorer, try to phase them out and switch to modern ones. Seriously, this should have been done 10 years ago.<\/li>\n<li>Then, when you no longer need IE compatibility, it\u2019s wise to disable the browser on all operating systems you use. For the above-listed operating systems, this will have to be done manually \u2014 the Microsoft website has a comprehensible <a href=\"https:\/\/learn.microsoft.com\/en-us\/troubleshoot\/developer\/browsers\/installation\/disable-internet-explorer-windows\" target=\"_blank\" rel=\"nofollow noopener\">list of instructions<\/a> on how to do this. For all other systems, make sure the relevant Microsoft patch is installed.<\/li>\n<li>According to Microsoft advice, you should continue to install security updates that apply to Internet Explorer even after you disable it, as applicable, because some components of the browser remain on the system.<\/li>\n<li>And, of course, use <a href=\"https:\/\/me-en.kaspersky.com\/small-to-medium-business-security?icid=me-en_kdailyplacehold_acq_ona_smm__onl_b2b_kasperskydaily_wpplaceholder_______\" target=\"_blank\" rel=\"noopener\">reliable protection<\/a> on all devices in your company.<\/li>\n<\/ul>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"kesb-trial\">\n","protected":false},"excerpt":{"rendered":"<p>In its February update, Microsoft buried Internet Explorer once and for all. Or did it? We investigate what really happened.<\/p>\n","protected":false},"author":2726,"featured_media":21031,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1318,1916,1486],"tags":[1636,25,38,268,113],"class_list":{"0":"post-21030","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-business","8":"category-enterprise","9":"category-threats","10":"tag-browsers","11":"tag-internet-explorer","12":"tag-microsoft","13":"tag-vulnerabilities","14":"tag-windows"},"hreflang":[{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/internet-explorer-is-finally-dead-or-is-it\/21030\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/internet-explorer-is-finally-dead-or-is-it\/25611\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/internet-explorer-is-finally-dead-or-is-it\/28256\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/internet-explorer-is-finally-dead-or-is-it\/25910\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/internet-explorer-is-finally-dead-or-is-it\/26314\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/internet-explorer-is-finally-dead-or-is-it\/28795\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/internet-explorer-is-finally-dead-or-is-it\/35242\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/internet-explorer-is-finally-dead-or-is-it\/48104\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/internet-explorer-is-finally-dead-or-is-it\/20550\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/internet-explorer-is-finally-dead-or-is-it\/21253\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/internet-explorer-is-finally-dead-or-is-it\/30103\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/internet-explorer-is-finally-dead-or-is-it\/26284\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/internet-explorer-is-finally-dead-or-is-it\/31918\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/internet-explorer-is-finally-dead-or-is-it\/31601\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/me-en.kaspersky.com\/blog\/tag\/vulnerabilities\/","name":"vulnerabilities"},"_links":{"self":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/21030","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/2726"}],"replies":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=21030"}],"version-history":[{"count":0,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/21030\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/21031"}],"wp:attachment":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=21030"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=21030"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=21030"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}