Serious security flaw found in IE
Users of the world's most common web browser have been advised to switch to a rival until a serious security flaw has been fixed. — The flaw in Microsoft's Internet Explorer could allow criminals to take control of people's computers and steal their passwords, internet experts say.
Context & Ripple Effects
Microsoft had already issued fixes for critical Internet Explorer problems in 2005. Reports on December 11 that it was investigating attacks capable of remote code execution put the browser's security response under renewed scrutiny.
The advice to use an alternative browser turns a vulnerability response into an immediate product-choice decision for Internet Explorer users, rather than a background patch-management issue.
First-order effects
- Internet Explorer users face an immediate choice between limiting use of the browser and accepting exposure to attacks that may take control of computers or steal passwords.
- Microsoft must contain the zero-day flaw and restore confidence in Internet Explorer while users are being directed to rival browsers.
Second-order effects
- Rival browser vendors gain a timely opening to convert temporary safety-driven switching into continued use, raising the cost to Microsoft of any delayed fix.
- Organizations dependent on Internet Explorer must weigh disruption from changing browser use against the risk of compromised employee credentials and machines.
Third-order effects
- Repeated critical-fix episodes make browser security response speed a competitive product attribute, not solely a technical maintenance function.
- If users treat unpatched browser flaws as grounds to switch, dominant-browser share becomes more contestable during security incidents.
The trend: Browser competition is increasingly shaped by whether vendors can respond credibly to actively exploitable security flaws.