Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Allow scripting of Internet Explorer WebBrowser controls

This setting determines whether pages in the Internet zone can use script to control an embedded Internet Explorer WebBrowser control.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1206
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1206

This setting determines whether pages in the Internet zone can use script to control an embedded Internet Explorer WebBrowser control. The WebBrowser control is an ActiveX component through which applications can host web content using Internet Explorer and MSHTML technology.

The 1206 value is a REG_DWORD associated with the URLACTION_ACTIVEX_NO_WEBOC_SCRIPT URL action:

  • 0 permits script access to embedded WebBrowser controls.
  • 3 prevents that script access.

The HKLM location represents computer policy, while the HKCU location represents user policy. Zone identifier 3 limits the setting to content classified by Windows as belonging to the Internet zone.

Notes

Security

Allowing script access enables Internet-zone code to interact with an embedded, ActiveX-based WebBrowser control. This increases the attack surface where a control or its host application contains vulnerabilities or exposes unsafe functionality. The actions available to a page still depend on the control, the hosting application, and other applicable security policies.

This setting does not by itself enable all scripting or ActiveX content, nor does it grant a page general operating-system privileges. Separate zone policies governing active scripting, ActiveX execution, and control safety continue to apply.

Possible side effects

Blocking script access can disrupt legacy websites or applications that automate an embedded WebBrowser control. Features that depend on this interaction might stop responding or provide reduced functionality.

Notes

When the policy is not configured, users can influence script access through the relevant security settings. By default, script access to the WebBrowser control is allowed only in the Local Machine and Local Intranet zones, not in the Internet zone.

Microsoft documentation

Microsoft Learn: Policy CSP – InternetExplorer: InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls

Microsoft Learn: URL Action Flags

Microsoft Learn: URL Policy Flags

See also