Microsoft updates SmartScreen tech to block drive-by attacks for Internet Explorer 11 and Edge on Windows 10
Microsoft expands SmartScreen to block drive-by attacks in IE and Edge on Windows 10 — Last month, Microsoft rolled out the first major Windows 10 update for PCs and tablets.
Context & Ripple Effects
The SmartScreen expansion lands mid-arc in Microsoft's 2015 browser split: earlier that year the company settled on a dual-engine strategy where Project Spartan shipped a new Edge rendering engine while Internet Explorer 11 stayed on Trident for enterprise compatibility (Spartan gets the Edge engine, IE 11 keeps Trident). That decision is what makes this update necessary — Microsoft now has to secure two engines on one OS rather than one.
It also builds directly on the malicious-ad warnings Microsoft added to IE earlier in 2015, moving from alerting users to outright blocking. The through-line is clear: with enterprises pinned to IE 11 and consumers pushed to Edge, Microsoft is layering protection at the browser-agnostic SmartScreen level so both engines benefit.
First-order effects
- Enterprises still standardizing on IE 11 get drive-by attack blocking without migrating off Trident, narrowing the security gap between the legacy browser they run and the Edge browser Microsoft wants them on.
- Websites serving ads laced with malicious code face harder blocking rather than just user warnings, cutting the reach of that infection channel on Windows 10.
Second-order effects
- Attack economics shift: as drive-by downloads get blocked by default, adversaries lean harder on vectors SmartScreen's page-reputation model covers less well, such as social engineering and phishing links delivered outside the browser.
- Competing browser vendors on Windows now have to match an OS-vendor-shipped blocking layer to avoid looking like the less safe option for enterprise deployments.
Third-order effects
- The trajectory points toward security consolidating inside the platform vendor — from SmartScreen here, through Defender's later silicon-assisted cryptojacking blocking, to protection baked into the OS rather than bolted on by third-party antivirus — though the limits show too: IE still needed an out-of-band remote code execution patch three years on, underscoring that legacy engines are a permanent tax until retired.
The trend: Browser security is shifting from per-browser patching toward OS-integrated blocking layers that cover every engine a platform vendor ships.