Hubbry Logo
Internet ExplorerInternet ExplorerMain
Open search
Internet Explorer
Community hub
Internet Explorer
logo
7 pages, 0 posts
0 subscribers
Be the first to start a discussion here.
Be the first to start a discussion here.
Internet Explorer
Internet Explorer
from Wikipedia

Internet Explorer
Other namesMicrosoft Internet Explorer (versions 1–6)
Windows Internet Explorer (versions 7–9)
IE
Original authorThomas Reardon
DeveloperMicrosoft
Initial releaseAugust 24, 1995; 30 years ago (1995-08-24)[1] (included with Plus! for Windows 95)
EnginesMSHTML (Trident), Chakra
Operating systemWindows (previously supported: Mac OS X, Solaris, HP-UX)
PlatformIA-32, x86-64, ARMv7 (previously supported: MIPS, Alpha, PowerPC, 68k, SPARC, PA-RISC, Itanium)
Included with
SuccessorMicrosoft Edge
StandardsHTML5, CSS3, WOFF, SVG, RSS, Atom, JPEG XR
Available in95 languages[2]
Type
LicenseProprietary, requires a Windows license[3]
Websitemicrosoft.com/ie

Internet Explorer[a] (formerly Microsoft Internet Explorer[b] and Windows Internet Explorer,[c] commonly abbreviated as IE or MSIE) is a retired series of graphical web browsers developed by Microsoft that were used in the Windows line of operating systems. While IE has been discontinued on most Windows editions, it remains supported on certain editions of Windows, such as Windows 10 LTSB/LTSC.[4] Starting in 1995, it was first released as part of the add-on package Plus! for Windows 95 that year. Later versions were available as free downloads or in-service packs and included in the original equipment manufacturer (OEM) service releases of Windows 95 and later versions of Windows. Microsoft spent over US$100 million per year on Internet Explorer in the late 1990s,[5] with over 1,000 people involved in the project by 1999.[6][7] In 2016, Microsoft Edge was released to succeed Internet Explorer 11 as Microsoft's primary web browser. New feature development for Internet Explorer was discontinued that same year,[8] and support for the browser officially ended on June 15, 2022, for Windows 10 Semi-Annual Channel (SAC) editions.

Internet Explorer was once the most widely used web browser, attaining a peak of 95% usage share by 2003.[9] It has since fallen out of general use after retirement. This came after Microsoft used bundling to win the first browser war against Netscape, which was the dominant browser in the 1990s. Its usage share has since declined with the launches of Firefox (2004) and Google Chrome (2008) and with the growing popularity of mobile operating systems such as Android and iOS that do not support Internet Explorer. Microsoft Edge, IE's successor, first overtook Internet Explorer in terms of market share in November 2019. Versions of Internet Explorer for other operating systems have also been produced, including an Xbox 360 version called Internet Explorer for Xbox and for platforms Microsoft no longer supports: Internet Explorer for Mac and Internet Explorer for UNIX (Solaris and HP-UX), and an embedded OEM version called Pocket Internet Explorer, later rebranded Internet Explorer Mobile, made for Windows CE, Windows Phone, and, previously, based on Internet Explorer 7, for Windows Phone 7.

The browser has been scrutinized throughout its development for its use of third-party technology (such as the source code of Spyglass Mosaic, used without royalty in early versions) and security and privacy vulnerabilities, and the United States and the European Union have determined that the integration of Internet Explorer with Windows has been to the detriment of fair browser competition.

The core of Internet Explorer 11 will continue being shipped and supported until at least 2029 as IE Mode, a feature of Microsoft Edge, enabling Edge to display web pages using Internet Explorer 11's Trident layout engine and other components.[10] Through IE Mode, the underlying technology of Internet Explorer 11 partially exists on versions of Windows that do not support IE11 as a proper application, including newer versions of Windows 10, as well as Windows 11, Windows Server 2022 and Windows Server 2025.[11]

History

[edit]

Internet Explorer 1

[edit]
Logo for Internet Explorer 2

The Internet Explorer project was started in the summer of 1994 by Thomas Reardon,[12] who, according to former project lead Ben Slivka,[13] used source code from Spyglass, Inc. Mosaic, which was an early commercial web browser with formal ties to the pioneering National Center for Supercomputing Applications (NCSA) Mosaic browser.[14][15] In late 1994, Microsoft licensed Spyglass Mosaic for a quarterly fee plus a percentage of Microsoft's non-Windows revenues for the software.[15] Although bearing a name similar to NCSA Mosaic, Spyglass Mosaic had used the NCSA Mosaic source code sparingly.[16]

The first version, dubbed Microsoft Internet Explorer, was installed as part of the Internet Jumpstart Kit in the Microsoft Plus! pack for Windows 95.[17] The Internet Explorer team began with about six people in early development.[16][18] Internet Explorer 1.5 was released several months later for Windows NT and added support for basic table rendering. By including it free of charge with their operating system, they did not have to pay royalties to Spyglass Inc, resulting in a lawsuit and a US$8 million settlement on January 22, 1997.[14][15]

Microsoft was sued by SyNet Inc. in 1996, for trademark infringement, claiming it owned the rights to the name "Internet Explorer".[19] It ended with Microsoft paying $5 million to settle the lawsuit.[20]

Internet Explorer 2

[edit]

Internet Explorer 2 is the second major version of Internet Explorer, released on November 28, 1995, for Windows 95 and Windows NT, and on April 23, 1996, for Apple Macintosh[21] and Windows 3.1.[22]

Internet Explorer 3

[edit]

Internet Explorer 3 is the third major version of Internet Explorer, released on August 13, 1996, for Microsoft Windows and on January 8, 1997, for Apple Mac OS.[23]

Internet Explorer 4

[edit]

Internet Explorer 4 is the fourth major version of Internet Explorer, released in September 1997 for Microsoft Windows, Mac OS, Solaris, and HP-UX. It was the first version of Internet Explorer to use the Trident web engine.

Internet Explorer 5

[edit]

Internet Explorer 5 is the fifth major version of Internet Explorer, released on March 18, 1999, for Windows 3.1, Windows NT 3, Windows 95, Windows NT 4.0 SP3, Windows 98, Mac OS X (up to v5.2.3), Classic Mac OS (up to v5.1.7), Solaris and HP-UX (up to 5.01 SP1).

Internet Explorer 6

[edit]

Internet Explorer 6 is the sixth major version of Internet Explorer, released on August 24, 2001, for Windows NT 4.0 SP6a, Windows 98, Windows 2000, Windows ME and as the default web browser for Windows XP and Windows Server 2003.

Internet Explorer 7

[edit]

Internet Explorer 7 is the seventh major version of Internet Explorer, released on October 18, 2006, for Windows XP SP2, Windows Server 2003 SP1 and as the default web browser for Windows Vista, Windows Server 2008 and Windows Embedded POSReady 2009. IE7 introduces tabbed browsing.

Internet Explorer 8

[edit]

Internet Explorer 8 is the eighth major version of Internet Explorer, released on March 19, 2009, for Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008 and as the default web browser for Windows 7 (later default was Internet Explorer 11) and Windows Server 2008 R2.

Internet Explorer 9

[edit]

Internet Explorer 9 is the ninth major version of Internet Explorer, released on March 14, 2011, for Windows 7, Windows Server 2008 R2, Windows Vista Service Pack 2 and Windows Server 2008 SP2 with the Platform Update.

Internet Explorer 10

[edit]

Internet Explorer 10 is the tenth major version of Internet Explorer, released on October 26, 2012, and is the default web browser for Windows 8 and Windows Server 2012. It became available for Windows 7 SP1 and Windows Server 2008 R2 SP1 in February 2013.

Internet Explorer 11

[edit]

Internet Explorer 11 is featured in Windows 8.1, Windows Server 2012 R2 and Windows RT 8.1, which was released on October 17, 2013. It includes an incomplete mechanism for syncing tabs. It is a major update to its developer tools,[24][25] enhanced scaling for high DPI screens,[26] HTML5 prerender and prefetch,[27] hardware-accelerated JPEG decoding,[28] closed captioning, HTML5 full screen,[29] and is the first Internet Explorer to support WebGL[30][31][32] and Google's protocol SPDY (starting at v3).[33] This version of IE has features dedicated to Windows 8.1, including cryptography (WebCrypto),[24] adaptive bitrate streaming (Media Source Extensions)[34] and Encrypted Media Extensions.[29]

Internet Explorer 11 was made available for Windows 7 users to download on November 7, 2013, with Automatic Updates in the following weeks.[35]

Internet Explorer 11's user agent string now identifies the agent as "Trident" (the underlying browser engine) instead of "MSIE". It also announces compatibility with Gecko (the browser engine of Firefox).

Microsoft claimed that Internet Explorer 11, running the WebKit SunSpider JavaScript Benchmark, was the fastest browser as of October 15, 2013.[36]

Internet Explorer 11 was made available for Windows Server 2012 and Windows Embedded 8 Standard in April 2019.[37]

End of life

[edit]

Microsoft Edge [Legacy] was officially unveiled on January 21, 2015, as "Project Spartan".[38][39] On April 29, 2015, Microsoft announced that Microsoft Edge would replace Internet Explorer as the default browser in Windows 10.[40] However, Internet Explorer remained the default web browser on the Windows 10 Long Term Servicing Channel (LTSC) and on Windows Server until 2021, primarily for enterprise purposes.[41][42][43][44]

Internet Explorer is still installed in Windows 10 to maintain compatibility with older websites and intranet sites that require ActiveX and other legacy web technologies.[38][39] The browser's MSHTML rendering engine also remains for compatibility reasons.

Additionally, Microsoft Edge (Chromium) shipped with the "Internet Explorer mode" feature, which enables support for legacy internet applications. This is possible through use of the Trident MSHTML engine, the rendering code of Internet Explorer.[45][46] Microsoft has committed to supporting Internet Explorer mode at least through 2029, with a one-year notice before it is discontinued.[47]

With the release of Microsoft Edge [Legacy], the development of new features for Internet Explorer ceased. Internet Explorer 11 was the final release, and Microsoft began the process of deprecating Internet Explorer. During this process, it will still be maintained as part of Microsoft's support policies.[8]

Since January 12, 2016, only the latest version of Internet Explorer available for each version of Windows has been supported.[48][49] At the time, nearly half of Internet Explorer users were using an unsupported version.[50]

In February 2019, Microsoft Chief of Security Chris Jackson recommended that users stop using Internet Explorer as their default browser.[51]

Various websites have dropped support for Internet Explorer. On June 1, 2020, the Internet Archive removed Internet Explorer from its list of supported browsers, due to the browser's dated nature.[52] Since November 30, 2020, the web version of Microsoft Teams can no longer be accessed using Internet Explorer 11, followed by the remaining Microsoft 365 applications since August 17, 2021.[53][54] WordPress also dropped support for the browser in July 2021.[55]

Microsoft disabled the normal means of launching Internet Explorer in Windows 11 and later versions of Windows 10,[56] but it is still possible for users to launch the browser from the Control Panel's browser toolbar settings or via PowerShell.[57]

On June 15, 2022, Internet Explorer 11 support ended for the Windows 10 Semi-Annual Channel (SAC). Users on these versions of Windows 10 were redirected to Microsoft Edge starting on February 14, 2023, and visual references to the browser (such as icons on the taskbar) would have been removed on June 13, 2023. However, on May 19, 2023, various organizations disapproved, leading Microsoft to withdraw the change.[58][59] Other versions of Windows that were still supported at the time were unaffected. Specifically, Windows 7 ESU, Windows 8.x, Windows RT; Windows Server 2008/R2 ESU, Windows Server 2012/R2 and later; and Windows 10 LTSB/LTSC continued to receive updates until their respective end of life dates.[60][61][62][63]

On other versions of Windows, Internet Explorer will still be supported until their own end of support dates. IE7 was supported until October 10, 2023, alongside the end of support for Windows Embedded Compact 2013, while IE9 is supported until January 13, 2026, alongside the end of [paid and grandfathered] Premium Assurance support for customers on Windows Server 2008.[49] Barring additional changes to the support policy, Internet Explorer 11 will be supported until January 13, 2032, concurrent with the end of support for Windows 10 IoT Enterprise LTSC 2021.[64][49]

Features

[edit]
Page zoom as seen in IE11. The lowest allowed manual zoom level is 10%, and the highest 1000%.[65]

Internet Explorer has been designed to view a broad range of web pages and provide certain features within the operating system, including Microsoft Update. During the height of the browser wars, Internet Explorer superseded Netscape only when it caught up technologically to support the progressive features of the time.[66][better source needed]

Standards support

[edit]

Internet Explorer, using the MSHTML (Trident) browser engine:

  • Supports HTML 4.01, parts of HTML5, CSS Level 1, Level 2, and Level 3, XML 1.0, and DOM Level 1, with minor implementation gaps.
  • Fully supports XSLT 1.0 as well as an obsolete Microsoft dialect of XSLT often referred to as WD-xsl, which was loosely based on the December 1998 W3C Working Draft of XSL. Support for XSLT 2.0 lies in the future: semi-official Microsoft bloggers have indicated that development is underway, but no dates have been announced.
  • Almost full conformance to CSS 2.1 has been added in the Internet Explorer 8 release.[67][68] The MSHTML browser engine in Internet Explorer 9 in 2011, scored highest in the official W3C conformance test suite for CSS 2.1 of all major browsers.
  • Supports XHTML in Internet Explorer 9 (MSHTML Trident version 5.0). Prior versions can render XHTML documents authored with HTML compatibility principles and served with a text/html MIME-type.
  • Supports a subset[69] of SVG in Internet Explorer 9 (MSHTML Trident version 5.0), excluding SMIL, SVG fonts and filters.

Internet Explorer uses DOCTYPE sniffing to choose between standards mode and a "quirks mode" in which it deliberately mimics nonstandard behaviors of old versions of MSIE for HTML and CSS rendering on screen (Internet Explorer always uses standards mode for printing). It also provides its own dialect of ECMAScript called JScript.

Internet Explorer was criticized by Tim Berners-Lee for its limited support for SVG, which is promoted by W3C.[70]

Non-standard extensions

[edit]

Internet Explorer has introduced an array of proprietary extensions to many of the standards, including HTML, CSS, and the DOM. This has resulted in several web pages that appear broken in standards-compliant web browsers and has introduced the need for a "quirks mode" to allow for rendering improper elements meant for Internet Explorer in these other browsers.

Internet Explorer has introduced several extensions to the DOM that have been adopted by other browsers.

These include the inner HTML property, which provides access to the HTML string within an element, which was part of IE 5 and was standardized as part of HTML 5 roughly 15 years later after all other browsers implemented it for compatibility,[71] the XMLHttpRequest object, which allows the sending of HTTP request and receiving of HTTP response, and may be used to perform AJAX, and the designMode attribute of the content Document object, which enables rich text editing of HTML documents.[citation needed] Some of these functionalities were not possible until the introduction of the W3C DOM methods. Its Ruby character extension to HTML is also accepted as a module in W3C XHTML 1.1, though it is not found in all versions of W3C HTML.

Microsoft submitted several other features of IE for consideration by the W3C for standardization. These include the 'behavior' CSS property, which connects the HTML elements with JScript behaviors (known as HTML Components, HTC), HTML+TIME profile, which adds timing and media synchronization support to HTML documents (similar to the W3C XHTML+SMIL), and the VML vector graphics file format. However, all were rejected, at least in their original forms; VML was subsequently combined with PGML (proposed by Adobe and Sun), resulting in the W3C-approved SVG format, one of the few vector image formats being used on the web, which IE did not support until version 9.[72]

Other non-standard behaviors include: support for vertical text, but in a syntax different from W3C CSS3 candidate recommendation, support for a variety of image effects[73] and page transitions, which are not found in W3C CSS, support for obfuscated script code, in particular JScript.Encode,[74] as well as support for embedding EOT fonts in web pages.[75]

Favicon

[edit]

Support for favicons was first added in Internet Explorer 5.[76] Internet Explorer supports favicons in PNG, static GIF and native Windows icon formats. In Windows Vista and later, Internet Explorer can display native Windows icons that have embedded PNG files.[77][78]

Usability and accessibility

[edit]

Internet Explorer makes use of the accessibility framework provided in Windows. Internet Explorer is also a user interface for FTP, with operations similar to Windows Explorer. Internet Explorer 5 and 6 had a side bar for web searches, enabling jumps through pages from results listed in the side bar.[79] Pop-up blocking and tabbed browsing were added respectively in Internet Explorer 6 and Internet Explorer 7. Tabbed browsing can also be added to older versions by installing MSN Search Toolbar or Yahoo Toolbar.

Cache

[edit]

Internet Explorer caches visited content in the Temporary Internet Files folder to allow quicker access (or offline access) to previously visited pages. The content is indexed in a database file, known as Index.dat. Multiple Index.dat files exist which index different content—visited content, web feeds, visited URLs, cookies, etc.[80]

Prior to IE7, clearing the cache used to clear the index but the files themselves were not reliably removed, posing a potential security and privacy risk. In IE7 and later, when the cache is cleared, the cache files are more reliably removed, and the index.dat file is overwritten with null bytes.

Caching has been improved in IE9.[81]

Group Policy

[edit]

Internet Explorer is fully configurable using Group Policy. Administrators of Windows Server domains (for domain-joined computers) or the local computer can apply and enforce a variety of settings on computers that affect the user interface (such as disabling menu items and individual configuration options), as well as underlying security features such as downloading of files, zone configuration, per-site settings, ActiveX control behavior and others. Policy settings can be configured for each user and for each machine. Internet Explorer also supports Integrated Windows Authentication.

Architecture

[edit]
The architecture of IE8. Previous versions had a similar architecture, except that both tabs and the UI were within the same process. Consequently, each browser window could have only one "tab process".

Internet Explorer uses a componentized architecture built on the Component Object Model (COM) technology. It consists of several major components, each of which is contained in a separate dynamic-link library (DLL) and exposes a set of COM programming interfaces hosted by the Internet Explorer main executable, iexplore.exe:[82]

  • WinInet.dll is the protocol handler for HTTP, HTTPS, and FTP. It handles all network communication over these protocols.
  • URLMon.dll is responsible for MIME-type handling and download of web content, and provides a thread-safe wrapper around WinInet.dll and other protocol implementations.
  • MSHTML.dll houses the MSHTML (Trident) browser engine introduced in Internet Explorer 4, which is responsible for displaying the pages on-screen and handling the Document Object Model (DOM) of the web pages. MSHTML.dll parses the HTML/CSS file and creates the internal DOM tree representation of it. It also exposes a set of APIs for runtime inspection and modification of the DOM tree. The DOM tree is further processed by a browser engine which then renders the internal representation on screen.
  • IEFrame.dll contains the user interface and window of IE in Internet Explorer 7 and above.
  • ShDocVw.dll provides the navigation, local caching and history functionalities for the browser.
  • BrowseUI.dll is responsible for rendering the browser user interface such as menus and toolbars.[83]
Internet Explorer compared to Firefox on the Acid3 HTML rendering test

Internet Explorer does not include any native scripting functionality. Rather, MSHTML.dll exposes an API that permits a programmer to develop a scripting environment to be plugged-in and to access the DOM tree. Internet Explorer 8 includes the bindings for the Active Scripting engine, which is a part of Microsoft Windows and allows any language implemented as an Active Scripting module to be used for client-side scripting. By default, only the JScript and VBScript modules are provided; third party implementations like ScreamingMonkey (for ECMAScript 4 support) can also be used. Microsoft also makes available the Microsoft Silverlight runtime that allows CLI languages, including DLR-based dynamic languages like IronPython and IronRuby, to be used for client-side scripting.

Internet Explorer 8 introduced some major architectural changes, called loosely coupled IE (LCIE). LCIE separates the main window process (frame process) from the processes hosting the different web applications in different tabs (tab processes). A frame process can create multiple tab processes, each of which can be of a different integrity level, each tab process can host multiple web sites. The processes use asynchronous inter-process communication to synchronize themselves. Generally, there will be a single frame process for all web sites. In Windows Vista with protected mode turned on, however, opening privileged content (such as local HTML pages) will create a new tab process as it will not be constrained by protected mode.[84]

Extensibility

[edit]

Internet Explorer exposes a set of Component Object Model (COM) interfaces that allows add-ons to extend the functionality of the browser.[82] Extensibility is divided into two types: Browser extensibility and content extensibility. Browser extensibility involves adding context menu entries, toolbars, menu items or Browser Helper Objects (BHO). BHOs are used to extend the feature set of the browser, whereas the other extensibility options are used to expose that feature in the user interface. Content extensibility adds support for non-native content formats.[82] It allows Internet Explorer to handle new file formats and new protocols, e.g. WebM or SPDY.[82] In addition, web pages can integrate widgets known as ActiveX controls which run on Windows only but have vast potentials to extend the content capabilities; Adobe Flash Player and Microsoft Silverlight are examples.[82] Add-ons can be installed either locally, or directly by a web site.

Since malicious add-ons can compromise the security of a system, Internet Explorer implements several safeguards. Internet Explorer 6 with Service Pack 2 and later feature an Add-on Manager for enabling or disabling individual add-ons, complemented by a "No Add-Ons" mode. Starting with Windows Vista, Internet Explorer and its BHOs run with restricted privileges and are isolated from the rest of the system. Internet Explorer 9 introduced a new component – Add-on Performance Advisor. Add-on Performance Advisor shows a notification when one or more of installed add-ons exceed a pre-set performance threshold. The notification appears in the Notification Bar when the user launches the browser. Windows 8 and Windows RT introduce a Metro-style version of Internet Explorer that is entirely sandboxed and does not run add-ons at all.[85] In addition, Windows RT cannot download or install ActiveX controls at all; although existing ones bundled with Windows RT still run in the traditional version of Internet Explorer.[85]

Internet Explorer itself can be hosted by other applications via a set of COM interfaces. This can be used to embed the browser functionality inside a computer program or create Internet Explorer shells.[82]

Security

[edit]

Internet Explorer uses a zone-based security framework that groups sites based on certain conditions, including whether it is an Internet- or intranet-based site as well as a user-editable whitelist. Security restrictions are applied per zone; all the sites in a zone are subject to the restrictions.

Internet Explorer 6 SP2 onwards uses the Attachment Execution Service of Microsoft Windows to mark executable files downloaded from the Internet as being potentially unsafe. Accessing files marked as such will prompt the user to make an explicit trust decision to execute the file, as executables originating from the Internet can be potentially unsafe. This helps in preventing the accidental installation of malware.

Internet Explorer 7 introduced the phishing filter, which restricts access to phishing sites unless the user overrides the decision. With version 8, it also blocks access to sites known to host malware. Downloads are also checked to see if they are known to be malware-infected.

In Windows Vista, Internet Explorer by default runs in what is called Protected Mode, where the privileges of the browser itself are severely restricted—it cannot make any system-wide changes. One can optionally turn this mode off, but this is not recommended. This also effectively restricts the privileges of any add-ons. As a result, even if the browser or any add-on is compromised, the damage the security breach can cause is limited.

Patches and updates to the browser are released periodically and made available through the Windows Update service, as well as through Automatic Updates. Although security patches continue to be released for a range of platforms, most feature additions and security infrastructure improvements are only made available on operating systems that are in Microsoft's mainstream support phase.

On December 16, 2008, Trend Micro recommended users switch to rival browsers until an emergency patch was released to fix a potential security risk which "could allow outside users to take control of a person's computer and steal their passwords." Microsoft representatives countered this recommendation, claiming that "0.02% of internet sites" were affected by the flaw. A fix for the issue was released the following day with the Security Update for Internet Explorer KB960714, on Microsoft Windows Update.[86][87]

In 2010, Germany's Federal Office for Information Security, known by its German initials, BSI, advised "temporary use of alternative browsers" because of a "critical security hole" in Microsoft's software that could allow hackers to remotely plant and run malicious code on Windows PCs.[88]

In 2011, a report by Accuvant, funded by Google, rated the security (based on sandboxing) of Internet Explorer worse than Google Chrome but better than Mozilla Firefox.[89][90]

A 2017 browser security white paper comparing Google Chrome, Microsoft Edge [Legacy], and Internet Explorer 11 by X41 D-Sec in 2017 came to similar conclusions, also based on sandboxing and support of legacy web technologies.[91]

Security vulnerabilities

[edit]

Internet Explorer has been subjected to many security vulnerabilities and concerns such that the volume of criticism for IE is unusually high. Much of the spyware, adware, and computer viruses across the Internet are made possible by exploitable bugs and flaws in the security architecture of Internet Explorer, sometimes requiring nothing more than viewing of a malicious web page to install themselves. This is known as a "drive-by install". There are also attempts to trick the user into installing malicious software by misrepresenting the software's true purpose in the description section of an ActiveX security alert.

A number of security flaws affecting IE originated not in the browser itself, but in ActiveX-based add-ons used by it. Because the add-ons have the same privilege as IE, the flaws can be as critical as browser flaws. This has led to the ActiveX-based architecture being criticized for being fault-prone. By 2005, some experts maintained that the dangers of ActiveX had been overstated and there were safeguards in place.[92] In 2006, new techniques using automated testing found more than a hundred vulnerabilities in standard Microsoft ActiveX components.[93] Security features introduced in Internet Explorer 7 mitigated some of these vulnerabilities.

In 2008, Internet Explorer had a number of published security vulnerabilities. According to research done by security research firm Secunia, Microsoft did not respond as quickly as its competitors in fixing security holes and making patches available.[94] The firm also reported 366 vulnerabilities in ActiveX controls, an increase from the previous year.

According to an October 2010 report in The Register, researcher Chris Evans had detected a known security vulnerability which, then dating back to 2008, had not been fixed for at least six hundred days.[95] Microsoft says that it had known about this vulnerability, but it was of exceptionally low severity as the victim web site must be configured in a peculiar way for this attack to be feasible at all.[96]

In December 2010, researchers were able to bypass the "Protected Mode" feature in Internet Explorer.[97]

Vulnerability exploited in attacks on U.S. firms

[edit]

In an advisory on January 14, 2010, Microsoft said that attackers targeting Google and other U.S. companies used software that exploits a security hole, which had already been patched, in Internet Explorer. The vulnerability affected Internet Explorer 6 from on Windows XP and Server 2003, IE6 SP1 on Windows 2000 SP4, IE7 on Windows Vista, XP, Server 2008, and Server 2003, IE8 on Windows 7, Vista, XP, Server 2003, and Server 2008 (R2).[98]

The German government warned users against using Internet Explorer and recommended switching to an alternative web browser, due to the major security hole described above that was exploited in Internet Explorer.[99] The Australian and French governments also issued a similar warning a few days later.[100][101][102][103]

Major vulnerability across versions

[edit]

On April 26, 2014, Microsoft issued a security advisory relating to CVE-2014-1776 (use-after-free vulnerability in Microsoft Internet Explorer 6 through 11[104]), a vulnerability that could allow "remote code execution" in Internet Explorer versions 6 to 11.[105] On April 28, 2014, the United States Department of Homeland Security's United States Computer Emergency Readiness Team (US-CERT) released an advisory stating that the vulnerability could result in "the complete compromise" of an affected system.[106] US-CERT recommended reviewing Microsoft's suggestions to mitigate an attack or using an alternate browser until the bug is fixed.[107][108] The UK National Computer Emergency Response Team (CERT-UK) published an advisory announcing similar concerns and for users to take the additional step of ensuring their antivirus software is up to date.[109] Symantec, a cyber security firm, confirmed that "the vulnerability crashes Internet Explorer on Windows XP."[110] The vulnerability was resolved on May 1, 2014, with a security update.[111]

Market adoption and usage share

[edit]
Usage share of web browsers according to StatCounter, 2008–2021
Historical market share of Internet Explorer, 1995–2024

The adoption rate of Internet Explorer seems to be closely related to that of Microsoft Windows, as it is the default web browser that comes with Windows. Since the integration of Internet Explorer 2.0 with Windows 95 OSR 1 in 1996, and especially after version 4.0's release in 1997, the adoption was greatly accelerated: from below 20% in 1996, to about 40% in 1998, and over 80% in 2000. This made Microsoft the winner in the infamous 'first browser war' against Netscape. Netscape Navigator was the dominant browser during 1995 and until 1997, but rapidly lost share to IE starting in 1998, and eventually slipped behind in 1999. The integration of IE with Windows led to a lawsuit by AOL, Netscape's owner, accusing Microsoft of unfair competition. The infamous case was eventually won by AOL but by then it was too late, as Internet Explorer had already become the dominant browser.

Internet Explorer peaked during 2002 and 2003, with about 95% share. Its first notable competitor after beating Netscape was Firefox from Mozilla, which itself was an offshoot from Netscape.

Approximate usage over time based on various usage share counters averaged for the year overall, or for the fourth quarter, or for the last month in the year depending on availability of reference.[112][113][114][115][116][117]

Internet Explorer's market share fell below 50% in September 2010.[118] In May 2012, Google Chrome overtook Internet Explorer as the most used browser worldwide, according to StatCounter.[119]

Industry adoption

[edit]

Browser Helper Objects are also used by many search engines companies and third parties for creating add-ons that access their services, such as search engine toolbars. Because of the use of COM, it is possible to embed web-browsing functionality in third-party applications. Hence, there are several Internet Explorer shells, and several content-centric applications like RealPlayer also use Internet Explorer's web browsing module for viewing web pages within the applications.

Removal

[edit]

While a major upgrade of Internet Explorer can be uninstalled in a traditional way if the user has saved the original application files for installation, the matter of uninstalling the version of the browser that has shipped with an operating system remains a controversial one.

The idea of removing a stock install of Internet Explorer from a Windows system was proposed during the United States v. Microsoft Corp. case. One of Microsoft's arguments during the trial was that removing Internet Explorer from Windows may result in system instability. Indeed, programs that depend on libraries installed by IE, including Windows help and support system, fail to function without IE. Before Windows Vista, it was not possible to run Windows Update without IE because the service used ActiveX technology, which no other web browser supports.[120][121]

Impersonation by malware

[edit]

The popularity of Internet Explorer led to the appearance of malware abusing its name. On January 28, 2011, a fake Internet Explorer browser calling itself "Internet Explorer – Emergency Mode" appeared. It closely resembled the real Internet Explorer but had fewer buttons and no search bar. If a user attempted to launch any other browser such as Google Chrome, Mozilla Firefox, Opera, Safari, or the real Internet Explorer, this browser would be loaded instead. It also displayed a fake error message, claiming that the computer was infected with malware and Internet Explorer had entered "Emergency Mode". It blocked access to legitimate sites such as Google if the user tried to access them.[122][123]

See also

[edit]

Notes

[edit]

References

[edit]

Further reading

[edit]
[edit]
Revisions and contributorsEdit on WikipediaRead on Wikipedia
from Grokipedia
Internet Explorer is a series of proprietary graphical web browsers developed by , initially released on August 16, 1995, as part of the Microsoft Plus! add-on package for Windows 95. The browser achieved widespread adoption through its tight integration with the Windows operating system, enabling seamless access for hundreds of millions of users and facilitating the mainstream expansion of the during the late 1990s and early 2000s. This default bundling contributed to Internet Explorer attaining a global desktop exceeding 90% at its peak around 2002–2003, as measured by usage . However, the practice sparked significant antitrust litigation, culminating in the United States v. Corp. case initiated in , where a federal court ruled that had unlawfully maintained its operating system monopoly by tying Internet Explorer to Windows to exclude competitors like . Over time, Internet Explorer encountered mounting challenges, including persistent security vulnerabilities that exposed users to exploits and a reputation for lagging in support for evolving web standards, which hindered developer efforts and web innovation. These issues, combined with the rise of open-source alternatives offering superior speed, , and compatibility, eroded its market position; by the early , its share had plummeted below 50%. Microsoft ultimately retired the Internet Explorer 11 desktop application on June 15, 2022, urging migration to its successor, , while retaining a for legacy enterprise needs until 2029.

History

Origins and Development (1995–1997)

Microsoft licensed the source code for Spyglass Mosaic, a commercial derivative of the NCSA Mosaic browser, in late 1994 for approximately $2 million upfront plus royalties on each distributed copy. This agreement enabled to develop its first amid growing adoption, following ' internal recognition of the web's strategic importance after initially underprioritizing it. The codenamed "O'Hare" project resulted in Internet Explorer 1.0, released on August 16, 1995, as part of the Microsoft Plus! add-on pack for Windows 95. This initial version supported basic rendering, inline images, and limited HTTP functionality but lacked features like tables and was restricted to 512-color displays on Windows platforms. Internet Explorer 1.5 followed in fall 1995 exclusively for Windows NT, introducing rudimentary HTML table support to address a key Mosaic limitation. Building on the Spyglass base with minimal modifications, Internet Explorer 2.0 launched on November 22, 1995, for Windows 95 and NT 3.51/4.0, and April 1996 for Macintosh. Enhancements included full table rendering, Java applet support via Microsoft Java Virtual Machine, and Progressive Networks' streaming audio/video plugins, alongside SSL encryption and 128-bit key support in a separate "Gold" edition. These updates aimed to close gaps with Netscape Navigator, which held over 90% market share, though IE remained an optional download rather than a core Windows component. By mid-1996, accelerated development to compete more aggressively, releasing Internet Explorer 3.0 on August 13, 1996, for Windows (with Macintosh following January 8, 1997). This version marked a shift from heavy reliance on Spyglass code, incorporating original rendering improvements for partial CSS1 compliance, elements, and controls for enhanced multimedia integration. Offered free of charge—eschewing retail packaging to minimize Spyglass royalties—IE 3.0 bundled with Internet Mail and clients, fostering ecosystem ties while drawing antitrust scrutiny for distribution tactics. Adoption grew modestly, capturing under 10% market share by late 1997, as invested in cross-platform ports and features like enhanced certificate handling.

Browser Wars and Dominance (1998–2005)

The intensification of the browser wars in 1998 saw Microsoft leverage the release of Windows 98 on June 25, which tightly integrated Internet Explorer 4.0, introducing features like Active Desktop that blurred lines between the OS and browser to enhance user experience through seamless web content rendering on the desktop. This bundling strategy, combined with free distribution to original equipment manufacturers (OEMs), accelerated IE's adoption amid competition from Netscape Navigator, which held a declining share after peaking at around 90% in 1995. By September 28, 1998, market research indicated IE had overtaken Netscape as the leading browser, capturing over 50% usage share by year's end. The U.S. Department of filed an antitrust against on May 18, 1998, alleging that the company unlawfully tied IE to Windows to exclude competitors like , thereby maintaining its operating system monopoly through exclusionary contracts with OEMs that restricted alternative browsers. countered that integration provided technical efficiencies, such as shared code for rendering and scripting, rather than mere anticompetitive tactics. In November 1998, acquired for $4.2 billion, but the deal failed to reverse Netscape's momentum loss, as its browser share continued eroding under IE's preinstalled ubiquity on Windows machines. Internet Explorer 5.0, released on March 18, 1999, further solidified gains with improved standards support and features like Components, achieving over 50% by early 2000 and pushing IE versions collectively above 80%. The antitrust trial concluded in 2000 with a ruling that violated Section 2 of the Sherman Act by willfully maintaining its monopoly, though appeals delayed remedies. IE 6.0 launched on August 27, 2001, bundled with (released October 25, 2001), emphasizing security enhancements and reaching approximately 95% within a year. A November 2001 settlement with the DOJ imposed behavioral restrictions, including allowing OEMs to customize desktop icons and promote rival software, but stopped short of unbundling or structural divestiture, permitting Microsoft to continue integrating the browser while sharing APIs with competitors. Despite these constraints, 's dominance endured through 2005, peaking at 95-96% usage share around 2002-2004, driven by Windows Update auto-deployments, network effects from web developers targeting -specific features, and user inertia on preinstalled software. This period marked 's unchallenged hegemony, as alternative browsers like Netscape's successors struggled against the default positioning on over 90% of PCs.

Post-Antitrust Improvements (2006–2013)

In response to competitive pressures and the stagnation of , Microsoft released on October 18, 2006, for , introducing tabbed browsing, an integrated feed reader, and a phishing filter to enhance security against online threats. The update also featured a redesigned user interface with a Favorites Center for managing bookmarks and feeds, aiming to improve usability after years of minimal changes. IE7 became the default browser in , reflecting Microsoft's efforts to align the product with evolving web standards and user expectations post-regulatory scrutiny. Internet Explorer 8, launched on March 19, 2009, emphasized standards compliance by introducing a standards rendering mode that supported CSS 2.1 and early HTML5 elements, alongside developer tools for debugging. New features included accelerators for quick actions like mapping or translation, and Web Slices for dynamic content updates without full page reloads, which sought to bridge proprietary extensions with broader web interoperability. These enhancements addressed prior criticisms of non-compliance, enabling better cross-browser consistency while maintaining backward compatibility options. Building on this, , released on March 14, 2011, incorporated GPU for rendering graphics and text, shifting processing from CPU to GPU to boost performance in web applications. The version featured a faster JavaScript engine and improved adherence to web standards, including better support for and WOFF fonts, which enhanced rendering speed and reduced compatibility issues. Internet Explorer 10, integrated with upon its October 26, 2012 release and later ported to on February 26, 2013, advanced touch-optimized interactions with features like "Flip Ahead" for gesture-based navigation and pinning sites to the Start screen. It enforced stricter compliance by default, removing the compatibility view button in Metro mode to prioritize modern standards, while bolstering security through sandboxing and iframe isolation. These updates positioned IE as more performant and ecosystem-integrated, responding to mobile and touch paradigms amid ongoing antitrust remedies requiring browser choice screens from 2011.

End of Mainstream Support and Removal (2014–2022)

In August 2014, Microsoft announced that it would end technical support and security updates for Internet Explorer versions 8, 9, and 10 on January 12, 2016, regardless of the host operating system's support status, shifting focus to Internet Explorer 11 as the sole supported version. This policy change aligned browser support more closely with platform maturity, emphasizing IE11's role in delivering modern web standards without further major version releases. On January 12, 2016, support for IE8, IE9, and IE10 officially ceased, leaving IE11 as the only actively maintained edition and prompting users of legacy versions to upgrade or face unpatched vulnerabilities. IE11's mainstream support phase, which included non-security fixes and feature enhancements, concluded in October 2020, transitioning to extended support limited to security updates. In May 2021, Microsoft declared that the desktop application would retire on June 15, 2022, for Semi-Annual Channel editions, with the browser redirecting users to featuring an IE compatibility mode to handle legacy sites. This retirement marked the end of all direct support for the standalone IE11 application, as prioritized Edge—initially rebuilt on the engine in January 2020—for improved performance, security, and cross-platform compatibility. Following the June 15, 2022, cutoff, IE11 ceased receiving updates and functionality on consumer Windows 10 versions, with remaining installations uninstalled as an optional feature via Windows Settings or PowerShell commands like Disable-WindowsOptionalFeature -Online -FeatureName "Internet-Explorer-Optional-amd64". A Microsoft Edge update on February 14, 2023, permanently disabled any lingering IE11 instances on supported systems, removing icons and shortcuts while preserving IE mode in Edge for enterprise needs until at least 2029. Enterprise editions of Windows 10 retained extended OS support beyond this date, but IE11 itself was no longer viable outside compatibility emulation.

Technical Architecture

Rendering Engine and Trident

Trident, also referred to as MSHTML, served as the proprietary rendering engine for Microsoft from version 4.0 to 11. Introduced with 4.0 in 1997, it marked Microsoft's shift from licensing the Spyglass Mosaic-derived engine used in earlier versions to developing its own layout component designed for integration into Windows applications. This engine handled parsing, CSS styling, and execution, enabling features like (DHTML) for dynamic page manipulation. Early iterations of Trident prioritized proprietary extensions over strict web standards compliance, resulting in rendering behaviors that diverged from specifications such as CSS1 and HTML 4.0. For instance, Internet Explorer 6, released in 2001 and reliant on Trident's foundational implementation, exhibited bugs like the "double margin" issue in floated elements and incomplete support for selectors, which necessitated workarounds in web development known as "IE-specific hacks." These inconsistencies stemmed from Trident's design focus on backward compatibility with legacy Microsoft content rather than full adherence to emerging W3C standards, contributing to fragmentation in cross-browser rendering during the browser wars era. Microsoft incrementally enhanced Trident's standards support in subsequent releases. Internet Explorer 7, launched in 2006, incorporated a rewritten layout core to better align with CSS 2.1, fixing over 500 rendering bugs and introducing alpha transparency for PNGs. Further refinements in (2009) added support for CSS 2.1 selectors and the <!DOCTYPE> enforcement for standards mode, while (2011) enabled hardware-accelerated rendering via GPU and partial HTML5/CSS3 features, achieving a score of 95/100 on the test—a benchmark for standards conformance. Despite these advances, Trident lagged in full implementation of modern APIs compared to competitors like and , with (2013) still requiring compatibility modes for legacy sites. The engine's final major iteration powered IE11's Trident 7.0, emphasizing performance optimizations but retaining quirks mode for enterprise compatibility.

Integration with Windows Ecosystem

Internet Explorer was bundled as the default with Windows operating systems beginning with version 2.0 included in OEM Service Release 1 (OSR1), released in August 1996, and 4.0. Subsequent versions, such as Internet Explorer 4.0 released on September 23, 1997, were pre-installed on and later editions including , XP, Vista, and 7, achieving peak through this distribution model. This bundling positioned IE as the system's primary handler for web protocols like HTTP and , directing invocations across applications to its rendering engine unless user-configured otherwise. A key aspect of integration emerged with Internet Explorer 4.0 via the Windows Desktop Update, which enabled shell-level features like —allowing HTML web content to be displayed as dynamic desktop backgrounds—and web view integration in Windows Explorer, where folder contents could render as HTML pages using IE's components. These enhancements relied on the (MSHTML) rendering engine, which was embedded in the for consistent web content display, extending beyond the browser to features like channel bars and subscribed web channels on the . The MSHTML engine was further shared with numerous Windows-native applications and components, including CHM-based Help files, for HTML email rendering, and utilities like the , ensuring uniform /CSS/ActiveX support system-wide but also creating dependencies that complicated removal or replacement. Updates to IE were delivered through starting prominently with integrations in (2001 onward), synchronizing browser security patches and features with OS maintenance to streamline ecosystem cohesion. This tight coupling, while boosting usability for web-integrated tasks, drew antitrust scrutiny in the late 1990s for hindering competition, as IE's protocols and shell hooks persisted even after attempted uninstallations in versions like Windows 98. Microsoft addressed partial decoupling in later releases, such as (2009), by permitting optional IE installation while retaining MSHTML for legacy compatibility.

Extensibility and ActiveX

Internet Explorer achieved extensibility primarily through controls, a Microsoft framework that enabled the embedding of reusable (COM)-based software components directly into web pages. technologies were formally announced by on March 12, 1996, as an evolution of earlier OLE () standards, with initial developer specifications available since January of that year. Support for hosting controls within HTML content was added in Internet Explorer 3.0, released on August 13, 1996, allowing web developers to insert interactive elements via the <OBJECT> tag. These controls facilitated advanced features such as dynamic forms, playback, and custom animations by leveraging native Windows APIs, offering performance advantages over cross-platform alternatives like Java applets, which relied on a . Developers could distribute signed binaries, authenticated via Microsoft's Authenticode system, which prompted users for installation approval, though unsigned controls faced stricter restrictions in later IE versions. This model supported "ActiveX Documents," enabling full applications—like word processors or spreadsheets—to render within the browser frame with their native toolbars and menus, enhancing integration with the Windows . Beyond core , Internet Explorer extended functionality through Browser Helper Objects (BHOs), COM interfaces registered in the that injected code into browser processes for tasks like or search enhancements, introduced around Internet Explorer 4.0 in 1997. Toolbars, another extensibility vector, allowed third-party additions via COM automation, with examples including the released in 2000, which hooked into IE's and menus. However, this deep system integration, where extensions ran in the browser's privileged context without sandboxing, exposed users to risks including if controls were malformed or malicious, contributing to IE's reputation for vulnerabilities in the late and early . gradually mitigated these through features like kill bits—registry entries disabling specific controls—and enhanced prompting in IE 6 (2001), but ActiveX remained Windows-centric and declined with the shift to standards-based web technologies.

Core Features

Standards Support and Proprietary Extensions

Internet Explorer's Trident rendering engine provided partial support for web standards from its early versions, but compliance was inconsistent and often lagged behind competitors. , released in August 1996, introduced the first commercial implementation of Cascading Style Sheets (CSS), though support was limited to basic properties and lacked full adherence to the CSS Level 1 specification. Subsequent versions, such as Internet Explorer 5.5 in 2000, exhibited significant deviations, including the notorious box model bug, where padding and borders were incorrectly included within the element's specified width and height, violating the W3C CSS model and necessitating widespread workarounds by developers. To accommodate legacy content while attempting standards adherence, Trident implemented distinct rendering modes starting with in 2001: quirks mode for pages without a proper DOCTYPE declaration, which emulated older IE behaviors like the incorrect box model, and standards mode triggered by a strict DOCTYPE, aiming for closer W3C compliance. in 2009 enhanced this with developer tools for mode switching and better CSS 2.1 support, while in 2011 added hardware-accelerated rendering and partial CSS3 features, achieving an test score of 95/100 (later revised to 100/100 after test updates). and 11 further improved, fully passing at 100/100 and scoring 355/500 on tests, though gaps persisted in areas like advanced CSS selectors and . IE compensated for standards shortcomings through proprietary extensions, prioritizing Windows integration over cross-browser portability. controls, introduced in 1996, enabled embedding of native Windows COM/OLE components into web pages for rich interactivity, such as multimedia or custom UI elements, but at the cost of security vulnerabilities and incompatibility with non-Windows browsers. provided IE-exclusive client-side scripting, allowing manipulation of page elements and invocation, distinct from the standardized (). Conditional comments, a Microsoft-specific feature from onward, permitted version-targeted code inclusion (e.g., <!--[if IE 6]> for IE6-specific styles), facilitating hacks for rendering bugs without affecting other browsers. Proprietary CSS properties further extended functionality, including -ms-filter for image effects like opacity and gradients (e.g., filter: progid:DXImageTransform.Microsoft.Alpha), which predated native CSS3 equivalents and encouraged non-standard authoring. These extensions, while enabling rapid feature deployment within the Windows ecosystem, fragmented the web by promoting IE-centric development and delaying universal standards adoption, as developers often optimized for Trident's quirks rather than W3C specifications. Later versions like IE11 deprecated some, such as , in favor of broader compliance, but legacy proprietary elements persisted for until IE's retirement.

Usability, Accessibility, and Caching Mechanisms

Internet Explorer introduced tabbed browsing in version 7, released in , enabling users to manage multiple web pages within a single window via tabs and Quick Tabs for previewing open tabs. This feature improved by reducing the need for multiple windows and facilitating easier navigation and comparison of content. Additionally, IE7 added a zoom capability, allowing users to enlarge or reduce page content using keyboard shortcuts like Ctrl + or Ctrl -, or via the menu, with levels ranging from 10% to 1,000% in later versions such as IE9. Security zones provided granular control over site permissions, categorizing sites into Internet, Local , Trusted, and Restricted zones to balance functionality and safety, though this sometimes restricted usability on untrusted sites. For accessibility, Internet Explorer integrated with Windows features such as modes and the Magnifier tool, supporting low-vision users through zoom and color adjustments accessible via Tools > Zoom or Internet Options > . Early versions like IE4.0, released in 1997, faced criticism for reducing for blind users by breaking compatibility with screen readers, marking a setback after prior improvements. Later iterations, including IE11, offered partial support for (WCAG) 2.1, though conformance remained browser-agnostic and dependent on developer implementation, with IE sometimes failing due to incomplete or standards support. Internet Explorer's caching mechanism relied on the Temporary Internet Files folder to store copies of web pages, images, and other resources, accelerating subsequent loads by serving from local disk rather than refetching from servers. Located at C:\Users[username]\AppData\Local\Microsoft\Windows\INetCache in and later, the cache size was user-configurable via Internet Options, defaulting to a of available disk to optimize while preventing excessive storage use. For DNS entries, IE4 and subsequent versions cached host resolutions with a 30-minute default timeout to balance speed and freshness, modifiable via HTTP headers to prevent stale content issues. Users could clear the cache manually through Internet Options > General > Delete Files to resolve display problems from outdated files.

Security and Privacy Implementations

Internet Explorer implemented several security mechanisms to mitigate risks from web-based exploits, beginning with the introduction of security zones in version 5.0, which categorized websites into four levels—Internet, Local intranet, Trusted sites, and Restricted sites—allowing administrators to apply tailored permission sets such as scripting controls and restrictions per zone. , launched in on October 18, 2006, confined the browser process to a low-integrity level within 's Mandatory Integrity Control, preventing malicious code from elevating privileges to modify system files or registry keys even if an exploit succeeded. This feature became mandatory for the Internet zone in on and subsequent operating systems, enforcing sandboxing by default. Further advancements included SmartScreen, initially deployed as a Phishing Filter in Internet Explorer 7 and rebranded and expanded in Internet Explorer 8 to scan URLs and file downloads against Microsoft's cloud-based reputation database, blocking known phishing sites, malware hosts, and suspicious binaries before execution. In Internet Explorer 10, released in 2012, Enhanced Protected Mode extended sandboxing by mandating 64-bit processes on compatible systems, activating full Address Space Layout Randomization (ASLR), disabling 32-bit low-rights Internet Explorer processes, and restricting file system and registry writes more aggressively, with opt-in enablement via advanced settings. Additional controls encompassed opt-in prompts for ActiveX controls starting in Internet Explorer 6, pop-up blocking from Internet Explorer 7, and integration with Windows features like Data Execution Prevention (DEP) and heap isolation. On the privacy front, Internet Explorer introduced InPrivate Browsing in version 8, enabling sessions where temporary Internet files, , form data, passwords, and are not persisted after tab closure, activated via a dedicated menu or shortcut (Ctrl+Shift+P). Tracking Protection, also debuting in and refined in version 9, permitted users to subscribe to curated lists of tracking domains—such as those from third-party advertisers or providers—which the browser then blocked from loading content or scripts, reducing cross-site without affecting core site functionality. further allowed granular management of (e.g., blocking third-party cookies by default in higher security zones), deletion of on demand, and, from Internet Explorer 9, support for the Do Not Track (DNT) header to signal websites against behavioral tracking, though compliance remained voluntary and uneven across publishers. These features emphasized user-configurable controls over automatic enforcement, aligning with Windows-integrated privacy tools like credential isolation.

Security Record

Early Vulnerabilities and Exploits

Internet Explorer's early security architecture, which emphasized seamless integration with the Windows operating system and support for controls introduced in version 3.0 (1996), inherently exposed users to risks from web-delivered code executing with system privileges. Unlike contemporary browsers that sandboxed content, IE allowed components—binary executables embedded in webpages—to access local resources without mandatory user consent in some cases, facilitating drive-by downloads and . This model prioritized functionality over isolation, leading to vulnerabilities where malformed or malicious web content could trigger overflows or bypass security prompts. The first documented major vulnerability appeared shortly after IE 3.0's release on August 13, 1996: the Princeton Word Loophole, disclosed on August 22, 1996. This flaw enabled webpages to silently download and execute macro viruses by exploiting IE's handling of embedded objects, bypassing user warnings and potentially infecting documents across the system. acknowledged the issue and issued a patch the following day, but critics noted it highlighted IE's aggressive default permissions, which treated web content as trusted by default. Throughout the late 1990s, ActiveX-related exploits proliferated, often leveraging buffer overflows or improper validation in controls bundled with IE or Windows. In September 1999, researcher George Guninski demonstrated an exploit using IE 5.0's ActiveX controls to erase hard drives remotely if a user visited a crafted page, exploiting unchecked parameters in system components like the Shell object. Similar issues persisted into 2000, including heap overflows in IE 5.x's Telnet protocol handler on Windows 95/98, allowing local privilege escalation via oversized inputs, though remote variants emerged through chained ActiveX invocations. These flaws stemmed from IE's reliance on COM (Component Object Model) interfaces without robust bounds checking, enabling attackers to overflow buffers and redirect execution flow. By 2001, the accumulation of undisclosed vulnerabilities prompted Microsoft to release MS01-058, a cumulative patch addressing all known issues in IE 5.5 and early IE 6, including cross-zone scripting and overflow conditions that could enable remote code execution via malicious HTML or script. Empirical data from advisories indicated over a dozen early exploits tied to and rendering flaws, with IE's market dominance—reaching 90% share by 2002—amplifying real-world impacts like widespread distribution. Despite patches, the pattern of reactive fixes underscored causal links between IE's Windows entanglement and exploitability, as web vectors directly invoked native APIs without intermediaries.

Evolution of Defenses and Major Patches

Internet Explorer's initial security defenses relied on reactive patching through , with Microsoft issuing fixes for specific vulnerabilities as they were discovered and exploited, such as the 2001 buffer overflow in IE's rendering that allowed remote code execution. Cumulative security updates became standardized with the introduction of in October 2003, delivering bundled fixes for IE vulnerabilities on the second Tuesday of each month to streamline deployment and reduce exposure windows. These early efforts addressed high-impact issues like flaws but lacked proactive mitigations, leading to persistent exploitation in versions up to IE6. A significant evolution occurred with , released on October 18, 2006, which introduced as a sandboxing mechanism running the browser in a low-integrity process on to prevent unauthorized modifications to system files or user data outside the Temporary Internet Files directory. This feature enforced mandatory integrity levels, isolating IE from higher-privilege processes and mitigating attacks, though it was initially limited to Vista and later extended to with service packs. Despite these advances, researchers demonstrated bypasses as early as December 2010, exploiting add-on interactions to escape the sandbox. Internet Explorer 8, launched in March 2009, integrated Data Execution Prevention (DEP) by default on supported Windows versions like XP SP3 and Vista SP1, preventing code execution in memory pages marked as non-executable to thwart exploits. It also enabled (ASLR) more comprehensively than prior versions, randomizing module load addresses to complicate attacks, alongside a new (XSS) filter that heuristically blocked reflected XSS payloads before rendering. These mitigations marked a shift toward layered defenses, though vulnerabilities persisted, with exploits bypassing both DEP and ASLR in targeted attacks by 2010. Subsequent releases built on this foundation: Internet Explorer 9 (March 2011) enhanced the XSS filter with improved heuristics and added domain-based sandboxing for untrusted content; IE10 (October 2012) introduced Enhanced Protected Mode on , extending sandbox isolation to 64-bit processes for broader reduction; and IE11 (October 2013) incorporated further refinements like stricter content security policies and hardware-accelerated rendering isolated from the main process. continued monthly cumulative patches through IE11's lifecycle, addressing dozens of remote code execution flaws annually, such as the 15 vulnerabilities patched in September 2021 alone, even as support waned post-2016 for consumer versions. This progression reflected causal adaptations to exploit trends, prioritizing memory protections and isolation over , though legacy dependencies often delayed full adoption.

Market Dynamics

Internet Explorer's market share expanded rapidly after its initial release in August 1995 as an optional add-on for , with adoption accelerating through bundling in subsequent Windows updates and versions like in 1998. This integration provided users with a pre-installed browsing option tied to the dominant desktop OS, leading to IE overtaking by the late 1990s as the browser of choice for Windows users. By early 2001, coinciding with the release of , the browser attained over 90% global usage share, reflecting its default status on Windows systems that powered the majority of internet-connected PCs. This dominance persisted through the early , with shares exceeding 90% until around 2003, driven by network effects where web developers optimized for IE's features and users benefited from compatibility within the Windows . The decline began in earnest in 2004 with the launch of , which eroded IE's share through faster rendering, better tab management, and plugin support, reaching double-digit percentages by late 2006. IE's stagnation after version 6—marked by delayed updates until IE7 in 2006 and persistent compatibility issues—compounded the loss, with market share dropping to 55.72% in desktop browsers by 2009. Google Chrome's debut in 2008 further intensified the shift, surpassing IE globally by late 2012 via superior speed, minimal interface, and aggressive distribution through services. Later iterations, including IE11 released in 2013, offered incremental improvements in standards compliance but could not stem the tide against cross-platform rivals emphasizing security and performance. Usage share fell below 20% by mid-decade, influenced by growth excluding IE and enterprise inertia favoring legacy support. Following official retirement on June 15, 2022, IE's active share neared zero, though vestigial usage lingered in compatibility modes within for legacy enterprise applications.

Competition from Rivals and Browser Wars

The first browser war erupted in the mid-1990s between and Microsoft's , as the web gained mainstream traction. , released in 1994, quickly captured approximately 80% of the browser market by mid-1995, fueled by its innovative features like support for and , which enabled richer web experiences. Microsoft responded by launching 1.0 in August 1995, initially as an add-on, but aggressively integrated subsequent versions—such as IE 3.0 in 1996 and IE 4.0 in October 1997—directly into Windows operating systems, leveraging the company's dominant OS market position to distribute the browser at no additional cost. This bundling strategy, combined with IE's improvements in rendering and compatibility with Windows-specific extensions, eroded Netscape's share; by late 1998, IE had surpassed Netscape, which held only about 20% of the market as users defaulted to the pre-installed option. IE's victory culminated in near-monopoly status, with market share peaking at around 95% by 2003, stifling innovation as Microsoft deprioritized browser development in favor of other products. Netscape, acquired by AOL in 1999, open-sourced its code in 1998, leading to the Mozilla project, but failed to regain ground amid IE's entrenchment. The war highlighted tensions over proprietary extensions versus open standards, with IE's divergence from W3C recommendations creating compatibility headaches for developers, though Microsoft's approach prioritized seamless integration for Windows users over cross-browser uniformity. The second phase of browser competition, often termed the second browser war, began around 2004 amid growing frustrations with IE's security vulnerabilities, sluggish updates, and non-adherence to web standards like CSS and . Mozilla Firefox 1.0, released on November 9, 2004, challenged IE by emphasizing standards compliance, tabbed browsing, and extensions, rapidly gaining traction—reaching about 30% by 2009—particularly among tech-savvy users and developers seeking alternatives to IE's proprietary quirks. IE's share began eroding, dropping below 60% globally by mid-2008, as Firefox's open-source model fostered community-driven improvements and highlighted IE's stagnation post-IE 6 in 2001. Google's Chrome, launched on September 2, 2008, intensified the rivalry with its focus on speed via the V8 JavaScript engine, sandboxed processes for security, and minimalistic interface, quickly surpassing Firefox to become the second-most-used browser by late 2011. Chrome's integration with Google services and aggressive auto-update mechanism propelled its growth, contributing to IE's further decline to under 50% market share by October 2010, as measured by usage analytics. By 2016, IE (including its successor Edge) held less than 10% share, overshadowed by Chrome's ecosystem advantages and Firefox's niche in privacy-focused users, underscoring how rivals' emphasis on performance, standards support, and frequent innovation displaced IE's legacy dominance.

Controversies and Criticisms

Antitrust Litigation and Monopoly Claims

The (DOJ), along with 20 states, initiated antitrust proceedings against on May 18, 1998, alleging that the company violated Section 2 of the by using its monopoly power in the market for Intel-compatible operating systems to stifle competition in web browsers. The complaint centered on 's practice of bundling Internet Explorer (IE) with and , including technical measures to integrate IE deeply into the OS, such as restricting original equipment manufacturers (OEMs) from removing IE icons or promoting alternatives like . Prosecutors claimed this tying arrangement foreclosed rivals from gaining distribution channels, as OEMs licensed Windows on terms that penalized non-compliance with 's browser preferences, contributing to IE's rapid growth from under 10% in mid-1995 to over 75% by 1999. In findings of fact issued November 5, 1999, Judge Thomas Penfield Jackson ruled that held a durable monopoly in the PC OS market with approximately 95% share, protected by high barriers including network effects and applications exclusivity, and that it unlawfully maintained this dominance by tying to Windows to eliminate the browser as a competitive to the OS platform. The court determined the relevant market for browsers as a platform for web navigation software, where Microsoft's actions, such as exclusive deals with service providers and developers to favor , aimed to commoditize browsers and neutralize middleware s like , which had initially commanded over 90% browser share in 1995. On April 3, 2000, Jackson held the bundling constituted an unlawful attempt to monopolize the browser market, rejecting Microsoft's defense that integration enhanced and user value, as evidence showed the tying served primarily exclusionary purposes rather than inherent technical superiority. The D.C. of Appeals, in a June 28, 2001, decision, upheld the monopoly maintenance finding but reversed the per se illegality of the IE-Windows bundling, applying a rule-of-reason analysis that required assessing potential pro-competitive benefits against anticompetitive harms. The case concluded with a November 2001 settlement under the Bush administration, avoiding a proposed structural and instead imposing behavioral remedies such as sharing APIs with rivals, disclosing technical information for , and prohibiting certain contracts restricting OEM flexibility for five years, though it did not mandate unbundling IE. Empirical data post-settlement showed browser competition revived with entrants like and Chrome eroding IE's share to below 20% by 2010, suggesting the remedies facilitated entry without evident consumer harm from prior bundling, as PC prices continued declining and web innovation accelerated. In the , the opened a formal investigation in January 2009 into 's continued bundling of IE as the default browser in Windows, deeming it an abuse of dominant position under Article 102 TFEU, following complaints from Software about restricted choice. settled on December 16, 2009, committing to a "browser choice screen" displayed to Windows users, offering selection from 12 browsers including non-IE options, with OEMs permitted to pre-install alternatives and set non-IE defaults; this addressed non-compliance issues from earlier media player bundling rulings. The Commission fined €561 million in 2013 (equivalent to about $731 million) for failing to show the screen to users of , Vista, and in 27 countries between May 2011 and July 2012 due to a technical error, underscoring ongoing scrutiny of default bundling's role in perpetuating browser lock-in despite 's OS dominance exceeding 90% in Europe during the period. The ballot screen was retired in 2014 after the commitments expired, by which time IE's share had fallen below 30%.

Impact on Web Standards and Developer Frustrations

Internet Explorer's rendering engine, , historically diverged from W3C standards by implementing proprietary extensions and incomplete support for specifications like CSS2, forcing developers to accommodate IE-specific behaviors rather than writing standards-compliant code. For example, IE5 and IE6 adopted a non-standard box model that incorporated padding and borders into an element's specified width, violating the CSS1 recommendation where width applies solely to content; this persisted in quirks mode for even after standards mode corrections via DOCTYPE triggers. Such deviations manifested in poor performance on interoperability tests from the Web Standards Project. IE6 and earlier failed Acid1 and Acid2 benchmarks outright, with Acid2—released in 2008 to assess CSS2, DOM, and alpha transparency support—not passed by IE until version 8 that year; meanwhile, IE8 scored just 20/100 on the more comprehensive test upon its 2009 launch, highlighting gaps in , DOM, and CSS3 rendering. Competitors like and achieved full compliance by 2011, underscoring IE's lag. Developers faced substantial frustrations, often expending disproportionate effort on IE-targeted workarounds like CSS hacks (e.g., underscore-prefixing for IE6 selectivity), conditional comments for version-specific stylesheets, and in to mitigate rendering bugs such as doubled margins on floated elements or absent min-width support. This "IE tax" inflated development time and costs, as sites built for IE's quirks rendered inconsistently elsewhere, prompting campaigns like the "IE6 must die" push by developers and the rise of frameworks like to abstract DOM inconsistencies. Microsoft's emphasis on preserving compatibility with the vast corpus of IE-optimized legacy sites—prioritizing market stability over rapid standards —exacerbated these issues, delaying broader web until competitive pressures from standards-focused rivals accelerated improvements in IE9 and later.

Legacy and Post-Retirement

Enterprise Dependencies and IE Mode in Edge

Following the retirement of the desktop application on June 15, 2022, numerous enterprises continued to depend on its rendering engine for compatibility with legacy web applications, particularly those built around proprietary technologies such as controls, Scripting Edition (), and custom sites developed under older web standards. These dependencies arose from decades of enterprise software tailored specifically to Internet Explorer's layout engine and non-standard extensions, which modern browsers like Chrome or do not support natively, often rendering critical line-of-business tools inoperable without intervention. Surveys and reports from 2023–2025 indicate that sectors like , , and retained significant usage, with some organizations estimating up to 20–30% of internal workflows still requiring IE compatibility post-retirement. To address these enterprise needs without fully maintaining the standalone browser, Microsoft integrated Internet Explorer mode (IE mode) into Microsoft Edge starting with version 77 in late , with broader rollout and policy controls announced in May 2021. IE mode embeds the IE11 rendering engine (/MSHTML) within Edge's Chromium-based framework, allowing administrators to configure specific sites or domains to load in this legacy mode via or registry settings, while defaulting other traffic to Edge's modern engine for improved performance and security. This hybrid approach supports features like enterprise site lists for automatic triggering—up to 5,000 URLs per list—and tab-specific reloading, enabling seamless transitions for users without disrupting workflows. committed to supporting IE mode through at least 2029, aligning with extended security updates for Enterprise LTSC editions that retain functional IE components. Despite facilitating gradual migration, IE mode has introduced persistent security challenges, as the underlying Trident engine remains vulnerable to exploits targeting deprecated code paths, including the Chakra JavaScript engine. In August 2025, Microsoft received reports of threat actors exploiting zero-day flaws in IE mode via social engineering tactics that tricked users into enabling it for malicious sites, prompting immediate restrictions in October 2025: administrators must now explicitly allow reloads, and direct URL invocations are blocked unless pre-approved. These measures reduced attack surfaces but highlighted the risks of prolonged reliance on legacy rendering, with experts noting that incomplete migrations—often due to high refactoring costs for ActiveX-dependent apps—prolong exposure in environments where full modernization remains uneconomical. Microsoft recommends inventorying dependencies, testing in IE mode, and prioritizing rewrites using modern APIs like Web Components, though adoption varies, with some enterprises deferring transitions beyond 2029 via custom policies.

Ongoing Security Risks and Migration Challenges

Following the retirement of on June 15, 2022, the browser ceased receiving security updates, rendering it susceptible to exploitation by unpatched vulnerabilities. Enterprises continuing to deploy IE for legacy applications face heightened risks, as threat actors have actively targeted the outdated engine, including through zero-day flaws that force the browser to load despite its disabled state on Windows systems. For instance, in 2024, attackers exploited CVE-2024-38112, a high-severity spoofing vulnerability, to trick systems into opening malicious files via IE components, enabling installation without user interaction. Even reliance on Microsoft Edge's IE compatibility mode has not fully mitigated these threats, as hackers have abused it via to activate legacy rendering and execute exploits. In response, restricted direct access to IE mode in Edge on October 10, 2025, requiring explicit site-list configuration to curb unauthorized invocations by adversaries exploiting unpatched IE flaws. Despite global usage dropping below 0.2% by 2024, enterprise environments persist with IE dependencies, contributing to an estimated 28 million residual users worldwide as of 2023 and amplifying attack surfaces in sectors like and . Migration to modern browsers such as Edge or Chrome presents substantial technical hurdles for organizations, primarily due to legacy web applications engineered around IE-exclusive features like controls, proprietary document modes, and conditional comments, which fail in standards-compliant engines. Refactoring these applications demands extensive code audits, testing, and redevelopment—often costing millions in resources for large-scale deployments—while interim use of IE mode perpetuates gaps and compliance violations under frameworks like PCI DSS or NIST. has urged accelerated transitions away from such dependencies, noting that prolonged IE mode usage exposes users to evolving threats without the benefits of contemporary protections like sandboxing or automatic updates. Partial mitigations, such as virtualized IE instances or third-party shims, introduce additional overhead and potential points of failure, delaying full modernization efforts reported by enterprises into 2025.

References

Add your contribution
Related Hubs
User Avatar
No comments yet.