CVE-2016-0162: Microsoft Internet Explorer Information Disclosure Vulnerability

CVE-2016-0162 is an information disclosure vulnerability in Microsoft Internet Explorer. It arises when the browser does not properly handle JavaScript, and it can allow an attacker to detect the presence of specific files on a user's computer. For IT and security teams this matters because file-existence checks can reveal software installs, configuration details, or other local artifacts that aid further targeting, even without direct code execution.

CISA notes the issue under CWE-200 and directs organizations to apply updates per vendor instructions. Ransomware use is not documented for this CVE. Confirm all version, configuration, and fix details against the Microsoft advisory before acting.

How it works

The weakness belongs to the information-disclosure class (CWE-200). Internet Explorer fails to handle certain JavaScript in a way that keeps local filesystem details private. An attacker who can cause the browser to process crafted script—typically by luring a user to a malicious or compromised page—may learn whether particular files exist on the endpoint.

This does not by itself grant arbitrary code execution or file contents. It supplies reconnaissance that can inform later stages of an attack. Exact trigger conditions and script constructs are not described in the supplied facts; treat any public proof-of-concept claims cautiously and validate behavior only in isolated lab environments against the vendor advisory.

Am I affected? How to find it in your systems

Internet Explorer has historically been present on Windows desktops, laptops, and some server or kiosk images, either as the default browser or as a compatibility component. Inventory every Windows system that still has IE installed or enabled, including older images, VDI pools, and systems that retain IE for legacy line-of-business applications.

• Use software inventory, SCCM/ConfigMgr, Intune, or vulnerability scanners to enumerate Internet Explorer installations and their patch levels.
• Cross-check installed IE builds and cumulative updates against the Microsoft security advisory for CVE-2016-0162; do not rely on generic version ranges.
• Identify systems where IE is still the default handler for web content or is launched by automated processes.
• Review proxy, web-gateway, and endpoint logs for unusual script-heavy pages or repeated navigation to untrusted domains that coincide with IE process activity. Telemetry signs of exploitation are not detailed in the facts, so treat anomalous IE JavaScript behavior or unexpected file-probing patterns as investigation leads rather than definitive indicators.

If IE has been removed or disabled and the advisory confirms the component is absent, residual risk from this CVE is low; still verify that no compatibility modes or embedded WebBrowser controls reintroduce the vulnerable code path.

How to remediate

Patch first. Apply the updates Microsoft released for this vulnerability exactly as described in the vendor advisory and per CISA's required action. Deploy through your normal test-and-rollout process, prioritizing internet-facing or high-risk user populations.

• After patching, confirm the update is present via inventory or the vendor's verification method.
• Where legacy applications no longer require IE, remove or disable the browser and migrate users to a supported modern browser.
• Enforce least privilege so that even successful reconnaissance yields limited value; restrict local admin rights and sensitive file locations.
• Keep Windows and related components current so that subsequent IE or scripting fixes are not missed.

Hardening for this class of flaw also includes reducing the attack surface of script execution inside the browser and ensuring users cannot casually browse untrusted sites with elevated privileges.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Segment or isolate systems that still run IE, limiting their ability to reach untrusted internet content.
• Use web proxies, secure web gateways, or browser isolation to block or sandbox suspicious JavaScript destinations.
• If policy allows, disable or restrict Internet Explorer via application control, Group Policy, or by changing file-type and protocol handlers so that links open in a different browser.
• Apply virtual patching or IPS/WAF rules that detect known patterns associated with IE script-based information disclosure only if your security vendor supplies signatures tied to this CVE; otherwise rely on generic script and exploit-kit protections.
• Increase monitoring on IE process starts, script errors, and outbound connections from legacy browser processes, and alert on anomalies until patches are complete.

These measures lower likelihood and impact but do not replace the official update.

If your data may have been exposed

Actively exploited vulnerabilities can lead to broader compromise even when the initial flaw only discloses information. If you have reason to believe systems were targeted while unpatched, examine endpoint and network logs for follow-on activity, rotate credentials that may have been at risk, and follow your incident-response process. You can run a free exposure scan of your email addresses against known breach data to check whether associated accounts appear in public breach corpora and then take appropriate credential-hygiene steps.