Launching applications and files in an IFRAME
The `1804` `REG_DWORD` value controls whether applications may be launched and files downloaded when a page assigned to the Restricted Sites zone (zone 4) initiates the operation through an IFRAME reference in its HTML.
since 0.9.8.11
Purpose
Show registry keys (2)
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1804HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1804
The 1804 REG_DWORD value controls whether applications may be launched and files downloaded when a page assigned to the Restricted Sites zone (zone 4) initiates the operation through an IFRAME reference in its HTML.
This URL action uses the following value data:
0: Allow the operation without prompting.1: Ask the user whether to allow the operation.3: Block the operation.
When the corresponding Restricted Sites zone policy is disabled or not configured, application launches and file downloads initiated in this manner are blocked.
Notes
Security
A value of 0 removes a protection associated with this URL action for the Restricted Sites zone. A page in that zone can initiate application or file operations from an IFRAME without obtaining the user's approval first. On an untrusted or compromised page, this increases exposure to unintended downloads or application launches.
This setting does not grant administrative privileges or automatically bypass other security controls. File-type handling, other security-zone policies, SmartScreen, access permissions, and the signed-in user's privileges can still restrict the resulting operation.
A value of 1 preserves an explicit user decision as an additional security boundary. A value of 3 blocks the operations covered by this URL action.
Possible side effects
A value of 3 can prevent legacy web applications from providing downloads or application launches through embedded IFRAMEs. A value of 1 can interrupt these workflows with recurring security prompts.
Notes
The Zones\4 key applies only to content mapped to the Restricted Sites zone. It is not a general Windows policy governing every application launch or file download.
The HKCU path represents the per-user policy scope, while the HKLM path represents the device policy scope. If the separate “Security Zones: Use only machine settings” policy is enabled, the Internet Explorer security-zone mechanism uses only the zone settings stored under HKLM.
This setting belongs to the legacy Internet Explorer security-zone architecture. Its effect is limited to applications and components that evaluate this Windows URL action through the Internet Explorer zone mechanism. Microsoft's current policy reference lists device and user support starting with Windows 10, version 1709.
Microsoft documentation
Microsoft Learn: Internet Explorer security zones registry entries for advanced users