MSHTML Framework Security Feature Bypass in Internet Explorer/MSHTML

CVE-2026-21513 is a high-severity protection mechanism failure in the Microsoft MSHTML Framework (the Internet Explorer rendering engine) that allows an unauthenticated attacker to bypass file-execution security controls over a network. Public reporting and vendor-linked analysis indicate the vulnerable logic is in MSHTML/ieframe.dll hyperlink navigation handling, where insufficient validation of attacker-controlled target URLs can route execution into ShellExecuteExW outside the intended browser trust context. In observed exploitation, attackers used malicious HTML content and specially crafted Windows Shortcut (.lnk) files, including LNKs with embedded HTML payloads, to manipulate browser and Windows Shell handling, bypass execution prompts, and defeat protections associated with untrusted network-origin content. Akamai reporting further states the technique used nested iframes and multiple DOM contexts to cross trust boundaries, enabling execution of local or remote resources outside the browser sandbox. Microsoft confirmed the flaw was exploited as a zero-day and fixed it in February 2026.