Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Allow VBScript to run in Internet Explorer

The `140C` registry value controls whether pages in the Internet zone may execute VBScript within Internet Explorer or its underlying MSHTML engine.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\140C
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\140C

The 140C registry value controls whether pages in the Internet zone may execute VBScript within Internet Explorer or its underlying MSHTML engine. It is a REG_DWORD value using the standard Internet Explorer URL-action policy values:

  • 0x00000000: run VBScript without prompting
  • 0x00000001: prompt the user before running VBScript
  • 0x00000003: prevent VBScript from running

The HKLM path represents the device-scoped policy, while the HKCU path represents the user-scoped policy. Zone number 3 limits this setting to the Internet zone.

Notes

Security

Allowing execution without prompting makes the legacy VBScript engine available to pages classified in the Internet zone, including untrusted web content. This increases the attack surface of the MSHTML environment. Script execution remains subject to the Internet Explorer or MSHTML security context and to other applicable browser and zone restrictions; this value does not grant administrative privileges or unrestricted operating-system script execution.

A value of 0x00000001 delegates each execution decision to the user. A value of 0x00000003 blocks execution and removes the VBScript attack surface from Internet-zone pages.

Possible side effects

Web applications that depend on client-side VBScript may be delayed by a prompt or may function only partially if permission is denied. Blocking execution can disable individual features or make an affected legacy application unusable.

Notes

This setting applies specifically to VBScript on Internet-zone pages. It does not enable Windows Script Host, enable VBScript in other security zones, or generally control other scripting languages.

Current Windows releases and appropriately updated older systems disable VBScript by default in the Internet and Restricted Sites zones. Consequently, current Microsoft policy documentation also describes the unconfigured state as blocking VBScript. Older documentation may still reflect the previous default behavior.

Microsoft Edge in Internet Explorer mode uses the Internet Explorer 11 MSHTML engine and supports Internet Explorer security-zone policies. This value can therefore affect Internet-zone pages rendered in IE mode, but it does not affect ordinary Edge pages rendered by the Chromium engine.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – InternetZoneAllowVBScriptToRunInInternetExplorer

Microsoft Learn: What is Internet Explorer mode?

Microsoft Learn: URL Policy Flags

See also