Mime Sniffing Safety Feature

Purpose

Show registry keys (14)

• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing\groove.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing\excel.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing\mspub.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing\powerpnt.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing\pptview.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing\visio.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing\winproj.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing\winword.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing\outlook.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing\spdesign.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing\exprwd.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing\msaccess.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing\onenote.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_sniffing\mse7.exe

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_SNIFFING feature separately for each listed executable. It applies when one of those processes handles web-based content through the legacy Internet Explorer and URLMON platform components.

MIME sniffing examines a file’s binary signature to identify its actual content type. The safety feature prevents content declared as a relatively safe type from being promoted through MIME detection to a more dangerous type, such as one capable of running script.

Each process name is a REG_DWORD value. A value of 1 enables the protection for that executable, while 0 disables it. This setting does not turn off MIME-type detection altogether; it restricts security-sensitive promotion from one detected type to a more dangerous type.

Notes

Security

Without this protection, an Office process using Internet Explorer components can treat misleadingly labelled web content as a more active or dangerous type. For example, content delivered as plain text could be handled as script-capable content when its structure indicates a different type.

Enabling the feature reduces this risk for the executable named by the registry value. It is not malware scanning, does not block all active content, and does not protect processes without an effective corresponding value. Final behavior can also depend on the Internet Explorer security-zone policy for URLACTION_FEATURE_MIME_SNIFFING.

Possible side effects

Incorrectly or incompletely labelled web content that depends on MIME-type promotion might be rendered differently, processed with additional restrictions, or prevented from behaving as intended in the affected Office processes.

Notes

The setting is process-specific. It does not govern every Office feature or the native parsing of Office document formats; it applies only to functionality that uses the relevant Internet Explorer or URLMON components.

Microsoft’s current security-baseline documentation lists onent.exe for OneNote, whereas the registry value set documented here contains onenote.exe. Because Feature Control values are matched to process names, these names are not technically interchangeable.

Microsoft documentation

Microsoft Learn: List of settings for the Microsoft 365 Apps for Enterprise security baseline in Intune

Microsoft Learn: InternetExplorer Policy CSP – MimeSniffingSafetyFeatureInternetExplorerProcesses

Microsoft Learn: INTERNETFEATURELIST enumeration

See also

• Entry in the reference