Advisory Details Published Date: August 10th, 2015 Title: Microsoft Internet Explorer add-on Installer Sandbox Escape Vulnerability Identifier: ZDI-15-377 ZDI-CAN-2874 CVE-2015-1743 CVSS Score: 6.9, AV:L/AC:M/Au:N/C:C/I:C/A:C Affected Vendors: Microsoft Affected Products: Internet Explorer Vulnerability Details: This vulnerability allows remote attackers to escape Enhanced Protected Mode on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability; the target must visit a malicious page or open a malicious file. The flaw lies in the add-on installer, where an attacker can bypass checks with special paths and junction points to execute code with medium integrity under user context. Additional Details: Microsoft issued an update to address this vulnerability. More details are available at: https://technet.microsoft.com/library/security/MS15-056 Disclosure Timeline: 2015-04-23: Vulnerability reported to vendor 2015-08-10: Coordinated public release Credit: Thomas Vanhoutte