CVE-2016-3298

Internet Explorer versions 9-11 have a flaw that lets attackers on a malicious website check if specific files exist on your computer without your knowledge, potentially exposing sensitive information about what's installed or stored on your system.

A remote attacker can craft a malicious website that leverages improper file existence validation in Internet Explorer 9-11 and the Internet Messaging API to determine whether arbitrary files exist on a victim's system. The attack requires user interaction (visiting a crafted website) and relies on observable differences in how the browser handles file access attempts, enabling information disclosure about the target system's file structure.