Skype cross-zone scripting vulnerability
Skype uses Internet Explorer web control within the application to render internal and external HTML pages. Examples for this pages are the “Send money via PayPal” dialog, or “Add video to chat” dialog. — Recently, I've discovered that Skype is running this web control in Local Zone.
Context & Ripple Effects
Skype enters 2008 on a security ledger that was already marked: last May a Skype worm variant spread by targeting other instant messaging clients, and the client itself had drawn criticism over resource behavior and abrupt withdrawal of London numbers. Now researcher Aviv Raff reports the deeper architectural issue — Skype renders its internal and external HTML pages, including the "Send money via PayPal" and "Add video to chat" dialogs, through an Internet Explorer web control running in the Local Zone.
The finding lands while Skype is pushing hard on new surfaces: a high-quality video release days earlier, a declared push into mobile calling, and rumors of Skype arriving on Sony's PSP. Every added dialog is another page the embedded control renders, which is what makes the zone configuration matter beyond a single bug.
First-order effects
- Skype users interacting with payment or media dialogs are directly exposed: a cross-zone script executed through the IE control can run with Local Zone privileges inside the application rather than the restricted internet zone.
- Skype must reconfigure or patch how its embedded web control assigns zones — the fix is a configuration change in the client, not a signature update.
Second-order effects
- Microsoft's IE web control becomes a liability by association: any Windows desktop vendor embedding it for rich UI inherits the same zone-management question Skype just failed, forcing those vendors to audit their own Local Zone usage.
- Enterprise buyers evaluating IM and VoIP clients gain a concrete criterion — how the app sandboxes embedded web content — which pressures rivals like consumer messengers bundling payment flows to document their own browser-control isolation.
Third-order effects
- If the pattern holds, desktop applications that bolt web rendering onto native clients face structural pressure toward hardened or segregated embedded browsers, making zone configuration a procurement requirement rather than an implementation detail.
- For Skype specifically, the episode fits a cadence of shipping capability faster than hardening — video, mobile, and platform expansion each widening the attack surface a single embedded control exposes.
The trend: Consumer VoIP and messaging clients are expanding into payments, video, and mobile faster than they harden the embedded web components those features depend on.