MSHTML Zero-Day in Windows Exploited by APT28 Prior to Feb 2026 Security Update
Microsoft has released its Patch Tuesday updates, addressing 59 vulnerabilities, including a critical zero-day flaw in the Windows MSHTML framework.
Microsoft has released its Patch Tuesday updates, addressing 59 vulnerabilities, including a critical zero-day flaw in the Windows MSHTML framework.
The identified vulnerability is tracked as CVE-2026-21513, which allows attackers to bypass security features and execute arbitrary code. The flaw is actively being exploited by APT28, a known advanced persistent threat group.
Feature Details
CVE ID CVE-2026-21513
CVSS Score 8.8 (High)
Vulnerability Type Security Feature Bypass
Microsoft has released its Patch Tuesday updates, addressing 59 vulnerabilities, including a critical zero-day flaw in the Windows MSHTML framework.
Affected Component MSHTML Framework ( ieframe.dll )
Threat Actor APT28 (Russian State-Sponsored)
Exploitation Status Actively Exploited In-the-Wild
The vulnerability is located in the ieframe.dll component, which manages hyperlink navigation for Internet Explorer. The code lacked proper validation for target URLs, allowing attackers to send malicious inputs to specific code paths that trigger the ShellExecuteExW function. This flaw allows threat actors to escape the browser's secure sandbox environment and execute arbitrary local or remote files on the victim's machine without warning.
Researchers identified that APT28 was using this vulnerability in late January 2026. The exploit involved a Windows Shortcut file ( .lnk ) with a hidden HTML payload connecting to an attacker-controlled domain to retrieve multistage malware. The attack leveraged nested iframes and multiple Document Object Model (DOM) contexts to bypass Windows security defenses, such as Mark of the Web (MotW) and Internet Explorer Enhanced Security Configuration (IE ESC).
While the observed campaign primarily used malicious .lnk files, experts caution that other applications embedding the MSHTML component could also trigger the vulnerability. As a result, various delivery methods beyond traditional phishing are possible.
In response, Microsoft introduced stricter hyperlink protocol validation in the February 2026 security patch update. This fix ensures that standard protocols such as HTTP, HTTPS, and FILE are contained and executed within the secure browser environment, preventing them from being passed directly to the ShellExecuteExW function, thus neutralizing the exploit chain.
Based on reporting by GBHackers.