CVE-2020-0674 is a scripting engine memory corruption vulnerability in Microsoft Internet Explorer. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 November 2021, which means attackers have used it in real attacks. Microsoft Internet Explorer contains a memory corruption vulnerability due to the way the Scripting Engine handles objects in memory.
Why this vulnerability class matters
A scripting engine memory corruption flaw in a browser is dangerous because it can let crafted content interfere with process memory, which may lead to code execution, crashes, or a broader compromise path in a user session. In a product like Internet Explorer, that matters because browsing is often the first step in a multi-stage attack chain.
For a practical overview of why exploited CVEs are prioritised, use the CVE Program as the record-level reference and the NIST National Vulnerability Database for canonical CVE metadata and product context.
How exposure is assessed
Exposure is usually determined by whether the vulnerable browser component is present, whether it is enabled in practice, and whether any systems still rely on it for legacy web content or embedded application compatibility. Asset inventory matters here, because organisations cannot remediate what they do not know is installed, reachable, or still used by end users.
Internet-facing endpoints, remote access paths, and long-lived desktop estates deserve particular attention when a browser exploit has been publicly abused. Vendor advisories and security bulletins are the authoritative sources for version-specific remediation details, while the vulnerability record helps confirm whether the issue is being actively exploited.
Remediation and compensating controls
When a patch is available, browser and operating system updates should be treated as high priority because memory corruption flaws are often chained into initial access or privilege escalation. If immediate remediation is not possible, organisations should reduce exposure by restricting use of the affected browser, limiting access to untrusted web content, and tightening application allowlisting and endpoint hardening where feasible.
For broader vulnerability handling, Vulnerability Management Guide is useful for prioritisation, verification, and remediation workflow design, especially when an issue is already known to be exploited.
Detection and post-exploitation review
Detection is rarely about the memory corruption event itself, because exploitation may first look like an ordinary browser session, followed by abnormal process behaviour, script activity, or suspicious child processes. Security teams should review endpoint telemetry, browser crash patterns, exploit delivery paths, and any follow-on activity that suggests the attacker moved from browser execution into persistence or credential access.
After patching, organisations should still review for signs of compromise before and after remediation, because known exploited vulnerabilities are often used to establish footholds before defenders can close the gap.
Risk and Threat Considerations
This vulnerability is materially risky because a browser memory corruption bug can be weaponised for drive-by compromise, especially when users visit hostile or compromised web content. The main concern is not only the initial browser crash or code execution, but the downstream opportunity it creates for malware delivery, session theft, or further system compromise.
Failure mechanism: A malformed object interaction in the scripting engine can corrupt memory state, allowing attacker-controlled code paths to execute in the browser process or adjacent context.
Impact: Successful exploitation can enable arbitrary code execution, user compromise, and a launch point for broader endpoint intrusion or lateral movement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | CVE remediation requires timely vulnerability correction on affected systems. |
| RA-5 — Vulnerability Monitoring and Scanning | Exposure assessment depends on inventorying where the vulnerable software is present. | |
| Recommendation — Prioritise SI-2 workflows to remediate the exploited browser flaw and verify deployment. Use RA-5 to identify affected hosts and track vulnerable browser deployments. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Actively exploited CVEs need continuous identification, prioritisation, and remediation. |
| Recommendation — Apply CIS-7 to prioritise and verify remediation of the exploited browser vulnerability. | ||
| MITRE ATT&CK | T1203 — Exploitation for Client Execution | Browser scripting engine exploitation is a client-side execution path used by attackers. |
| Recommendation — Map observed exploit behaviour to T1203 and hunt for client-side execution indicators. | ||
| NIST CSF 2.0 | PR.PS-03 — Configuration management is used to apply and maintain secure settings and approved software only. | The issue affects endpoint software exposure and secure configuration management. |
| Recommendation — Use PR.PS-03 to remove or constrain vulnerable browser exposure across endpoints. | ||
Practitioner Guidance
Why practitioners should care: Treat browser memory corruption issues as user-exposure problems, not just software defects. The most important judgement is whether vulnerable software is still reachable on managed endpoints, VDI estates, or legacy application environments that users continue to depend on.
What to watch for: Prioritise systems that browse the public internet, handle untrusted content, or support legacy compatibility features. If the browser cannot be removed immediately, reduce exposure by restricting its use and increasing endpoint monitoring around suspicious script-driven activity and post-exploit behaviour.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org