Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Launching applications and files in an IFRAME

This policy setting controls whether applications may be launched and files may be downloaded when referenced by an HTML `IFRAME` on a page in the Internet zone.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1804
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1804

This policy setting controls whether applications may be launched and files may be downloaded when referenced by an HTML IFRAME on a page in the Internet zone. Zone identifier 3 represents the Internet zone, while value name 1804 corresponds to the URLACTION_SHELL_VERB URL action.

The value uses the REG_DWORD type and has the following meanings:

  • 0: Applications and files may be launched or downloaded without prompting the user.
  • 1: The user is prompted before the application is launched or the file is downloaded.
  • 3: Launching applications and downloading files from an IFRAME is blocked.

For the associated ADMX policy, the documented Not configured behavior is to prompt the user. The HKLM and HKCU paths represent the device and user policy scopes, respectively.

Notes

Security

A value of 0 removes the consent prompt for this action. Content in the Internet zone can therefore initiate an application launch or file download from an IFRAME without first obtaining confirmation. On a malicious or compromised website, this increases exposure to unintended downloads or program launches.

A value of 1 retains an explicit user decision as an additional control, although it cannot prevent approval caused by deception or user error. A value of 3 blocks this launch path.

This setting does not grant elevated privileges or bypass other Windows or Internet Explorer security checks. Any permitted application still runs with the calling user's permissions and may remain subject to other protection mechanisms.

Possible side effects

A value of 3 can disrupt legacy web applications that use embedded frames to initiate downloads or open locally registered applications or file types. With a value of 1, these operations may be interrupted by security prompts and depend on a user decision.

Notes

This is an Internet Explorer security-zone setting and applies only to pages assigned to the Internet zone. It is not a general Windows control for application launches or file downloads, and it does not govern every download outside the described IFRAME context.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – InternetZoneLaunchingApplicationsAndFilesInIFRAME

Microsoft Learn: URL Action Flags – URLACTION_SHELL_VERB

Microsoft Learn: URL Policy Flags

See also