A security update is available that increases the enforcement of the cross-domain security model in Internet Explorer. This article is intended to notify developers of these changes and to provide information about possible workarounds that developers can use if their code is affected by these changes.
Security bulletin MS04-025 increases the enforcement of the cross-domain security model in Internet Explorer. For additional information about security bulletin MS04-025, visit the following Microsoft Web site:
For additional information about the cross-domain security model, visit the following Microsoft Web site:
Changes to Internet Explorer-based code
If your Internet Explorer-based code is affected by these changes, we recommended that you examine the security implications of your product and explore the following changes to your Internet Explorer-based code.
DHTML script access is removed during navigation
Script access to the Internet Explorer object model is removed immediately when the security context changes during navigation. This behavior prevents script in one security context from accessing the object model in another security context.
To work around this new behavior, update your DHTML script so that it does not rely on access to objects after navigation.
Enforcement of context for script URLs that are executed from binary code
To work around this new behavior, use the execScript
method or the setTimeout
method to execute script from your binary code.
For additional information, visit the following Microsoft Web sites: