EIP-2026-118840

This writeup describes a bypass for Microsoft Windows Internet Explorer 6.0 SP1 URI handler restrictions using HTTP redirects. It explains how an attacker can use an <object> tag to trigger a redirect to a restricted URI (e.g., file:// or res://), circumventing security measures.