Vulnerability record · CVE-2016-3351 · published 14 September 2016
CVE-2016-3351: Microsoft Internet Explorer and Edge information disclosure via crafted website
Microsoft · Internet Explorer
Internet Explorer 9 through 11 and Microsoft Edge disclose sensitive information when a user visits a crafted website. The record gives no detail on what data leaks or the underlying mechanism, but the flaw is remotely reachable and requires only that a victim load attacker-controlled content.
Description
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Automated analysis
high priorityThe flaw is remotely reachable with only user interaction, is in CISA KEV with known ransomware use, and carries a high EPSS percentile, though the record lacks detail on the exact data exposed.
What it is
Internet Explorer 9 through 11 and Microsoft Edge disclose sensitive information when a user visits a crafted website. The record gives no detail on what data leaks or the underlying mechanism, but the flaw is remotely reachable and requires only that a victim load attacker-controlled content.
Impact
An attacker can obtain sensitive information from the victim's browser context, which may expose data useful for further attacks. The record does not specify which data is disclosed.
Attack surface
Reached over the network through a crafted website; the CVSS vector shows no privileges required but user interaction required, so the victim must visit the page or open the crafted content.
Exploitation
CVE-2016-3351 is listed in CISA KEV with known ransomware campaign use, and EPSS gives a 30-day probability of 0.26286 (98th percentile); a reference is tagged Exploit, though the record does not describe the exploit itself.
What to do
- Apply the Microsoft updates referenced in MS16-104 and MS16-105, or later cumulative updates, to all affected IE and Edge installations.
- Retire Internet Explorer 9 through 11 where possible and standardize on a supported browser.
- Enforce browser isolation or restrict browsing to trusted sites for users who cannot be patched immediately.
- Block or filter untrusted web content at the network boundary and keep browser and OS patch levels current.
Detection
- Hunt for browser processes (iexplore.exe, MicrosoftEdge.exe) spawning unexpected child processes or writing unusual files after web browsing.
- Monitor proxy and DNS logs for access to known exploit-hosting or malvertising domains tied to browser information disclosure campaigns.
- Review endpoint telemetry for suspicious file downloads or MIME-type handling anomalies following browser sessions.
- Alert on KEV-listed CVE patch status for IE and Edge endpoints to confirm remediation.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2016-3351 to the Known Exploited Vulnerabilities catalog on 24 May 2022 as "Microsoft Internet Explorer and Edge Information Disclosure Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply updates per vendor instructions. Federal deadline 14 June 2022.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2016-3351 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-3351), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
