Abstract

This research investigates the legacy functionality of the Internet Explorer (IE) browser engine, with a particular focus on its lingering presence in modern systems and the associated security implications in 2025. Despite official deprecation, components of the IE engine continue to be leveraged in enterprise environments via embedded applications, legacy ActiveX controls, and compatibility modes in Microsoft Office and Windows utilities. A central concern explored in this paper is the threat posed by localhost-based Cross-Site Scripting (XSS) vulnerabilities, which remain exploitable in IE’s architecture due to its insecure handling of local resources, trust zones, and scripting behavior.

I will present several proof-of-concept exploits demonstrating the escalation of localhost XSS to NTLM leaks, UXSS, MOTW bypasses and full Remote Code Execution (RCE), leveraging default ie and windows features such as mhtml, ActiveX and explorer.exe functionality. These case studies are grounded in real-world bug bounty experiences, showcasing how attackers can pivot from trivial XSS vectors to high-impact system compromise, especially in corporate or hybrid Windows environments that retain IE compatibility layers.

While often dismissed as obsolete, Internet Explorer's remnants continue to offer both opportunities for exploitation and valuable insights for security researchers. Understanding its quirks remains relevant in offensive security, vulnerability research, and high-value bug bounty programs targeting legacy software stacks.