Helping people with computers... one answer at a time.

Using a browser other than Internet Explorer is very common and for many different reasons. Unfortunately, that doesn't mean you can ignore IE.

I keep seeing where hijacking, vulnerabilities, infections, etc., of various applications are prevalent. The latest one is another IE vulnerability; among other things. I believe there is a manual work-around for IE but no patch has been issued. I have IE8 installed. I use primarily Firefox (v3.6.13). My question is this ... am I still vulnerable to attach(s) although I do not use IE8; or whichever application may be installed on my computer? Thanks and good work!

In general if you don't have or use a particular piece of software then you can safely ignore the updates and or vulnerability notifications that you might run across.

In general.

Internet Explorer, on the other hand, is a special case. Use it or not, you must keep it up to date.

Internet Explorer Whether You Want It Or Not

The most obvious scenarios are these:

  • Some websites work only with Internet Explorer. As IE's market share declines this is less common, but since businesses can count on IE being on every Windows machine they'll sometimes simply take the easy way out and worry only about IE when designing their web site. Want to visit their site? You'll have to fire up IE.

  • Some software will automatically fire up Internet Explorer if you use online help or "Visit our website" types of features. Frequently they'll use IE even when it isn't your default browser.

"Even though you might not be using Internet Explorer, you're still using Internet Explorer."

There's little to be done in cases like this, other than to be slightly annoyed.

Internet Explorer will come up, whether you want it or not.

But at least it's obvious.

Internet Explorer is More Than Internet Explorer

The problem is actually more complex, albeit it conceptually fairly simple: Internet Explorer is found in more places than just Internet Explorer.

IE is comprised of several components - an HTML rendering engine, internet access components, bookmarking functionality and so on. Perhaps the most important, though, is that HTML rendering engine.

I'll use that as my example.

When you visit a web page the contents of the web page are described in HyperText Markup Language, or HTML. Everything from references to images to the highlighting of words is specified in HTML. The rendering engine's job is to read that HTML, interpret it and make things appear as instructed.

For example, when the rendering engine sees "<strong>this should be bold</strong>" as HTML input, it produces "this should be bold" as its output displayed in the browser.

Considering the scope of all that can be described in HTML, the rendering engine is a pretty complex and large piece of work.

HTML is also a fairly common markup language used in many more places that just web pages. Email, for example, is commonly in HTML these days, as are online help documents and even some software user interfaces.

It sure would be nice if we didn't have to create an entirely new HTML rendering engine for each different piece of software that might need to use one.

Well, that's exactly the situation we're faced with: the HTML rendering engine that we consider to be part of Internet Explorer is more properly a component of Windows itself. Email programs, help programs and all sorts of other programs may well be using the "guts" of Internet Explorer when they display their content.

Even though you might not be using Internet Explorer, you're still using Internet Explorer.

The most surprising cases are some of the "alternative" browsers themselves. While Firefox, Chrome and many others do indeed have their own independent rendering engines, some do not. Maxthon, for example, simply places its own user interface and feature set around the Internet Explorer HTML rendering engine.

Bottom Line: You're Using It, Keep It Updated

The bottom line to all this is indeed very simple: like it or not, you're using IE somewhere. As a result you'll want to make sure and keep it updated with all the latest security patches as they're made available.

You may do most of your web browsing using other tools, and that's just fine, but IE remains on your system, and remains a potential point of entry for malware to exploit.

Article C4709 - January 14, 2011 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

16 Comments
Black Dahlia
January 15, 2011 11:18 AM

I spent 7 years malware-free using unupdated IE with scripting and ActiveX turned of for non-trusted sites. I got my first drive-by virus using Firefox with the NoScripts add-on, and found myself not only unable to run any program (not just .exe but .com, .scr, etc.) but unable to ctrl-alt-del or boot into safe mode. I eventually defeated the malware by rapidly pressing enough keys during Windows startup to crash it.

I've been using Chrome for the last year but what started as a polished and fast piece of software has become a slow (load times are fine, but sometimes it takes several seconds to render a page) system resource hog. I am strongly considering switching back to IE, at least for script-heavy pages that seem to bog Chrome down.

Alex
January 18, 2011 10:59 AM

Why not just uninstall it? I use firefox and thunderbird - if a website only shows in I.E. I will happily avoid it.

Less clutter on the hard drive sounds good to me.

The core components of Internet Explorer that are shared by other applications and Windows itself cannot be uninstalled, and should be kept up to date.
Leo
19-Jan-2011

Frank Golden
January 18, 2011 3:45 PM

Because as Leo explained it is a part of Windows and it's HTML rendering engine is required for some Windows functions.

I suspect you mean unticking the IE box in Win 7 Control Panel>Programs and features>Turn Windows Features on or off.

That does not remove IE it just hides it.

As a matter of fact I'm running SP1 on my copy of Win 7 and that option isn't even available anymore.

Bill McComb
January 18, 2011 5:16 PM

My netbook dual boots to XP and Ubuntu. I use only Ubuntu. Do I need to update the XP and IE8 even though they are not being used?

If you never boot into it, then no. However if you never boot into it ... why is it there? If you do or might boot into XP I'd be tempted to keep it up to date.
Leo
19-Jan-2011

Frank Golden
January 19, 2011 5:43 AM

Why not get rid of XP if you only use Ubuntu.

If you still have some need of XP then you should keep it fully patched for those times you use XP.

Tony
February 5, 2011 3:05 PM

You imply that IE cannot be removed and should be kept updated. My IE8 stopped working a few months ago and I can't figure how to get it going again. What should be my next step in this scenario? I use Mozilla Firefox and Google Chrome for everything now.

thenudehamster
February 24, 2011 10:44 AM

Even if you only use Ubuntu, you may come across one of 'those' websites that try only to load and run IE - in which case you'll have to fire up some version of Windows if you want to visit the site.
As with so many things it makes sense to keep your Windows installation fully up to date, just in case. I have three machines dual-booting either XP or Vista and Ubuntu, but each one gets it's Windows updated once a week or so, in case I have to use it for something - or in case a non-Linux savvy friend needs temporary access and not a lesson... I still haven't installed IE8 on two of them though; I've seen too many issues reported to feel comfortable with it yet.

BobfromBellevue
February 24, 2011 11:59 AM

I use IE8 as it seems for me most logical and also it has one function which I use that the others don't have.
However, my question is - IE9 is almost here/there - please tell us, in your opinion, when we should install IE9. Thank you

I wouldn't advise average computer users to take it as an update for a couple of months at least. I'd also pay attention to the tech news to see about any issues that are uncovered. I'll be taking the update as aoon as it's available, but a) I backup completely every night, and b) trying this stuff out is my job. Smile
Leo
24-Feb-2011

Matt
February 24, 2011 1:54 PM

Nowhere does this truly indicate that IE8 updates really are essential for everyone even among Windows users. I can get away without IE browsing net for YEARS. The reason apparently is that Firefox can actually run IE8 within a shell, so I do in fact have IE8 installed, I'm just not in a hurry to update when M$ screams at me from taskbar. Intelligent use of internet webpages more effective generally.

The whole point of this article is that keeping Internet Explorer updated - regardless of version - is essential. You even made my point: the addons and options to use IE within FireFox are using IE - and therefor open to all vulnerabilities idenfied in Internet Explorer. You want those vulnerabilities patched.
Leo
24-Feb-2011

Bob
February 24, 2011 2:06 PM

Parts of IE are used all over the place in Windows, for example the Shell itself (Windows Explorer, the Desktop, etc.). Not to mention wininet, urlmon, and those other things that use them.

I get very bored with the shouting from contrarians. IE is not the Devil.

Mark Matis
February 24, 2011 2:22 PM

This is just one of the many reasons why I do not use Windows for financial activity. Not to mention the obvious back doors that Microsoft has given The Government. I mean, Microsoft had LOST the "monopoly" law suit and all of a sudden the Government rolls over and says "Never mind!" Shades of the DOJ with those black terrorists at the Philadelphia polling place. Do you REALLY think that Uncle got NOTHING in return?

Sorry, I'm not a conspriacy believer. There are no backdoors.
Leo
24-Feb-2011

Richard
February 24, 2011 11:16 PM

Leo, it sure is refreshing to find someone who does NOT buy into one of countless conspiracy ideas.

I'm curious: how did you prevent your example, "this should be bold" from being interpreted by my rendering engine so that it does just that, as it just did in my own question? In other words, how did you make "strong" (in those brackets) appear on the page without them executing the command to make the text bold? Did it require additional code that we don't see? (I know very little about HTML. But I guess if I played around with your comment form long enough -- I've already edited my message several times -- I could figure this out. :-))

Thanks for the IE update tip, which I think I always follow.

I use character encoding for the left and right angle brackets. &lt and &gt become < and > respectively.
Leo
25-Feb-2011

Iris
February 25, 2011 2:28 AM

Hi!
I don't know much about operating systems, so I hope it's not a silly question: how about other OS & default browsers? Should I worry about updating Firefox on Mandriva for example? Or do they not reuse the code the way Windows does?

I think this is a pretty Windows-specific thing.
Leo
25-Feb-2011

Engineeral
February 25, 2011 1:01 PM

What about Windows Updates, or Microsoft Updates? The easy way to acquire these updates is from the Microsoft Updates site and it only works with IE. Is there a way to get updates without using IE?

I think automatic updates doesn't use IE directly, but regardless - IE is being used on your machine elsewhere so keep it up-to-date.
Leo
25-Feb-2011

Matt
February 26, 2011 2:00 PM

The whole point of this article is that keeping Internet Explorer updated - regardless of version - is essential. You even made my point: the addons and options to use IE within FireFox are using IE - and therefor open to all vulnerabilities idenfied in Internet Explorer. You want those vulnerabilities patched.
But my point was the article did NOT really state the essential nature. Mine made the point better. Even then not so much for geeks.

Lauri Kopish
March 29, 2011 8:21 PM

OK. So I didn't keep it up to date, (though I thought I did). Now what? Can it be fixed?

Sure. Start accepting Windows Updates for it.
Leo
30-Mar-2011

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to http://askleo.com/ask to ask your question.