Microsoft warning over browser security flaw

Microsoft has issued a "critical" warning over a newly-discovered flaw in Windows.

Microsoft Security Advisory (2501696) - Vulnerability in MHTML Could Allow Information Disclosure

Workarounds are available under Mitigating Factors and Suggested Actions> Suggested Actions

 

Interesting that according to the bulletin a user would have to click a malicious link in an email message or on the Web page. But they do not mention that the site could use additional scripting to automatically load the URL in a hidden frame or inline frame, which is the most likely method that a criminal would use to exploit this vulnerability.

Or the malicious site could use scripting to run javascript confirms/alerts that execute the link when the user selects "No" in the confirm box.