CVE-2026-21513

What is Microsoft MSHTML?

MSHTML (also known as Trident) is Microsoft's HTML rendering engine, originally the core of Internet Explorer. While Internet Explorer itself was retired in 2022, the MSHTML engine (implemented in ieframe.dll and related components) remains present in all supported versions of Windows as a component used by legacy applications, Windows features, and third-party software that embeds web content. Because it was not designed with modern browser security boundaries, MSHTML operates with significantly fewer sandboxing protections than modern rendering engines. Vulnerabilities in MSHTML can bypass protections that browsers like Edge apply by default.

Overview

CVE-2026-21513 is a protection mechanism failure (CWE-693) in the MSHTML Framework's hyperlink navigation logic. Insufficient validation of target URLs in ieframe.dll allows attacker-controlled input to reach ShellExecuteExW code paths, executing local or remote resources outside the browser security context. This bypasses Mark-of-the-Web (MotW) controls and Internet Explorer Enhanced Security Configuration (IE ESC). Observed attacks used malicious .LNK files embedding HTML that triggered the vulnerable MSHTML code path. APT28 (Russian state-sponsored) exploited this as a zero-day before the February 2026 Patch Tuesday fix.

Affected Versions

Technical Details

The vulnerability (CWE-693: Protection Mechanism Failure) is in the hyperlink URL validation logic within ieframe.dll. When MSHTML processes a hyperlink navigation, it should validate the target URL and enforce zone-based security policies. The flaw allows URLs using file://, http://, and https:// schemes to bypass these checks and reach ShellExecuteExW, which executes the referenced resource outside normal browser security constraints.

Crafted .LNK files (Windows Shortcuts) embedding HTML can trigger this code path: when a user clicks the .LNK, the embedded HTML is processed by MSHTML, the malicious link is constructed, and ShellExecuteExW executes an attacker-controlled payload without SmartScreen or MotW intervention. An exploit sample with the filename document.doc.LnK.download appeared on VirusTotal on 30 January 2026, approximately 11 days before the patch. Microsoft's fix tightened hyperlink protocol validation to prevent file://, http://, and https:// links from reaching ShellExecuteExW.

Discovery

Akamai Security Research performed automated root cause analysis post-patch and correlated the fix to an in-the-wild exploit sample. Microsoft Threat Intelligence Center (MSTIC) and Google Threat Intelligence Group (GTIG) were also credited in the advisory.

Exploitation Context

Attributed to APT28 (Fancy Bear, Russian state-sponsored GRU-linked group). APT28 used crafted .LNK files connecting to the command-and-control domain wellnesscaremed[.]com to deliver payloads. The exploit pre-dates the February 2026 patch by at least 11 days based on the VirusTotal submission date. CISA added CVE-2026-21513 to the KEV catalog on Patch Tuesday, indicating active exploitation of government-relevant targets. This CVE was used in conjunction with CVE-2026-21510 (Windows Shell SmartScreen bypass) as part of the same LNK-based phishing campaign infrastructure.

Remediation

1. Apply the February 2026 Patch Tuesday cumulative update to all affected Windows systems immediately.
2. Disable legacy MSHTML/Internet Explorer mode in Edge and remove IE compatibility shims where not required by business-critical applications.
3. Block .LNK file delivery in email gateways — configure mail filtering to quarantine .LNK attachments from external senders.
4. Enable Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint to block execution of files from MSHTML-accessible paths.
5. Enable IE Enhanced Security Configuration (IE ESC) on Windows Server systems to reduce the attack surface of MSHTML-dependent code paths.
6. Monitor for connections to unusual domains from ieframe.dll-related processes (iexplore.exe, svchost.exe) and for ShellExecuteExW calls from unexpected callers.
7. IOC: Block the C2 domain wellnesscaremed[.]com at DNS and perimeter firewalls.