| Feb 2014 | DoS: execCommand EditMode from HTC Behavior File |
| Feb 2014 | DoS: WMP Object Inside createPopup, Hidden Immediately |
| Feb 2014 | DoS: Windows Media Player launchURL from Cross-Origin iFrame |
| Jan 2014 | DoS: Accessing Cached Element Collection After Page Redirect |
| Nov 2013 | DoS: document.open/close on createHTMLDocument or XHR Response Document |
| Oct 2013 | DoS: Accessing Destroyed Intl Object After iFrame Navigation |
| Oct 2013 | DoS: Loading MHTML Protocol URL in an iFrame |
| Oct 2013 | DoS: modelessDialog Redirect with Simultaneous Alert |
| Oct 2013 | DoS: Loading an MP3 Inside a Sandboxed iFrame |
| Oct 2013 | DoS: designMode + document.open from iFrame Crashes Browser |
| Oct 2013 | DoS: Loading Any URL via the MHTML Protocol Handler |
| Oct 2013 | DoS: Opening and Immediately Closing an RSS Feed Window |
| Sep 2013 | DoS: createPopup screenLeft Null Pointer |
| Aug 2013 | DoS: execCommand CreateLink on Mixed-Style Selection |
| Aug 2013 | DoS: window.open on a Closed Window |
| Mar 2013 | DoS via CSS Expression Error Loop |
| Mar 2013 | DoS Crash: ondragstart with document.open in Input Box |
| Feb 2013 | IE11 DoS via window.URL.createObjectURL |
| May 2012 | IE10 DoS: Cached document.links Collection After Redirect Crashes in jscript9 CrossSite Marshal |
| May 2012 | IE10 DoS: pushState to mhtml: URL Then window.open Crashes in urlmon StrCmpCW |
| Apr 2012 | IE10 DoS: msSetPointerCapture on Destroyed Element Crashes on Scrollbar Mouseover |
| Mar 2012 | IE10 DoS: Script Element Appended to createHTMLDocument Crashes Browser |
| Feb 2012 | IE10 DoS: Loading HTC Behavior from Blob URL via Server Redirect Crashes Browser |
| Feb 2012 | IE10 DoS: Blob URL in showModalDialog Creates Invisible Modal That Locks the Browser |
| Dec 2011 | IE10 DoS: Injected iFrame Redirect + Calling Non-Existent Method Triggers Stack Buffer Overrun |
| Dec 2011 | IE10 DoS: createPopup setInterval Crashes Browser After Redirect |
| Dec 2011 | IE10 DoS: Web Worker Sending XHR to a Blob URL Crashes the Browser |
| Dec 2011 | IE10 DoS: document.normalize() Crashes the Browser |
| Nov 2011 | DoS: Serving Different MIME Types to PresentationHost Crashes XBAP Loading |
| Nov 2011 | DoS: Setting designMode on a Non-HTML Window Crashes the Browser |
| Nov 2011 | IE10 DoS: Setting designMode in an HTC Behavior Crashes Browser |
| Oct 2011 | IE10 DoS: Calling document.open/close on Keypress in a Textarea Crashes Browser |
| Sep 2011 | IE10 DoS: AppCache Fallback with Auto-Refresh Crashes the Browser |
| Aug 2011 | IE9 DoS: createPopup with Plugin Crashes on iFrame Navigation |
| Jul 2011 | DoS: Loading an HTC Behavior on a createHTMLDocument Element Crashes IE |
| Jul 2011 | IE10 DoS: Dragging XML Content Crashes the Browser |
| Jun 2011 | DoS: Silverlight Content Object Cached Across Page Reload |
| Jun 2011 | IE9 DoS: Executing a Script in a Cached HTC Document After It Is Destroyed |
| May 2011 | IE9 Crash: Resizing a createPopup Belonging to a Dead IFrame |
| Mar 2011 | IE9 DoS: Object.defineProperty Crashes the Properties Dialog |
| Jan 2011 | IE9 DoS: parent.document.open from an iFrame |
| Jan 2011 | IE9 DoS: Executing a Method on a Closed Window |
| Dec 2010 | IE9 DoS: document.open on a New Trident Instance |
| Dec 2010 | IE9 DoS: xEval on Any Document Method |
| Nov 2010 | IE9 Crash (Deadcall): appendChild on a Dead createDocumentFragment |
| Nov 2010 | IE9 Crash (Deadcall): Calling show() of a Dead createPopup via Function.call |
| Nov 2010 | IE9 Crash (Deadcall): cloneRange on a Dead Range |
| Nov 2010 | IE9 Crash (Deadcall): toString on a Dead Selection Range |
| Nov 2010 | IE9 Crash: D3D VMware Driver Fault on Window Open and Navigate |
| Nov 2010 | IE9 Crash: Enumerating Properties of a Non-HTML Object Element |
| Sep 2010 | IE9 Crash: Calling document.open on a createPopup Document |
| Aug 2010 | IE9 Crash: Getting the Function Object from a Cached Document Method |
| Jul 2010 | IE9 Crash: XML Script Tag Written into an IFrame |
| Jul 2010 | IE9 Crash: Accessing SVG viewport Property from DOMParser |
| Jul 2010 | IE9 Crash: Inline document.write with createPopup in setInterval |
| Jul 2010 | IE9 Crash: Accessing Opener Window Object Repeatedly from Modeless Dialog |
| Jun 2010 | IE9 Crash: Window Method Cached Inside a Native JScript Object |
| Jun 2010 | IE Crash: Calling a Nulled Window Method in a Modeless Dialog |
| Jun 2010 | IE9 Crash: Accessing onmessage from a Modeless Dialog |
| May 2010 | IE9 Crash: Reloading an IFrame After Destroying It |
| May 2010 | IE9 Crash: Accessing a Document After Its IFrame Is Destroyed |
| May 2010 | IE9 Crash: Using a Selection Range After Window Reload |
| May 2010 | IE9 Crash: A Lone SVG Tag |
| Feb 2010 | IE Crash: Access Violation When Viewing Source of a 60 MB HTML Comment |
| Dec 2009 | IE Crash: Resizing a createPopup After Its Window Is Gone |
| Dec 2009 | IE Crash: createPopup Hide-and-Seek During Navigation |
| Nov 2009 | IE Crash: Calling Window Methods After Destroying an IFrame |
| Nov 2009 | IE8 Crash: Accessing an HTC Document After Reload |
| Nov 2009 | IE8 Crash: Cached Window Methods from an HTML Object's IFrame |
| Oct 2009 | IE DoS — Destroy Cached Flash IFrame Document |
| Oct 2009 | IE8 DoS — Non-HTML Content Opened in createPopup OBJECT |
| Sep 2009 | IE8 DoS — Reload Binary File in OBJECT Element |
| Sep 2009 | DoS — XAML Nested in XAML via IFrame |
| Sep 2009 | IE DoS — Cached window.open from Feeds IFrame Context |
| Jul 2009 | IE8 DoS — Access Violation in DevTools with Framed Feeds |
| Jun 2009 | Silverlight 3 DoS — Uncaught Exception in CallMethod |
| Jun 2009 | IE DoS — dataTransfer.setData with Invalid URL |
| May 2009 | IE8 DoS — Cached Image Constructor After Iframe Reload |
| May 2009 | Silverlight 3 DoS — Destroy Control While Update Dialog Is Open |
| May 2009 | Silverlight 3 DoS — Destroy Object During Install Dialog |
| Apr 2009 | IE8 DoS — XAML insertObject Crash |
| Mar 2009 | IE8 DoS — Prototype Property Crash on Properties Dialog |
| Mar 2009 | DoS — X-Frame-Options Reload Crash |
| Feb 2009 | DoS — X-Frame-Options Location Navigation Crash |
| Feb 2009 | DoS — htmlFile with Invalid Protocol and WMP launchURL |
| Dec 2008 | DoS: Reusing a Cached window.open Reference After Navigation |
| Dec 2008 | IE8 DoS — Feeds XML Inside Iframe with Nested Iframe |
| Nov 2008 | IE7 DoS via ExecWB OLECMDID_GETZOOMRANGE Missing Argument |
| Oct 2008 | DoS: IE8 Crashes via createPopup and SCRIPT DEFER |
| Sep 2008 | DoS: IE7 Crashes When Writing Flash via innerHTML on ONKEYPRESS |
| Aug 2008 | DoS: IE8 Crashes When Viewing Properties After Prototype Modification |
| Feb 2008 | DoS: Silverlight Crash via Enumerator on userControl |
| Feb 2008 | DoS: Silverlight Crash via innerHTML on Its Container |
| Oct 2007 | DoS: IE7 Crash via Cached SWF Document and res:// Protocol Navigation |
| Sep 2007 | DoS: createPopup Chain with Windows Media Player innerHTML |
| May 2007 | DoS - Frozen IE - userControl Run Two Forms |
| May 2007 | DoS: Cached Non-HTML Document Reloaded Twice |
| Apr 2007 | DoS - IE7 Close Browser via Enumerator Application |
| Apr 2007 | DoS - HTC Cached Document |
| Apr 2007 | DoS - WPFE Cached OnError Handler |
| Apr 2007 | DoS - IE7 Dead IFRAME Access |
| Apr 2007 | DoS - designMode DTD XHTML |
| Mar 2007 | DoS - IE7 onBeforeUnload document.write |
| Feb 2007 | DoS - IE7 Cached Methods from Window Object |
| Feb 2007 | DoS - document.execCommand SaveAs |
| Feb 2007 | DoS - IE7 Close Window No Prompts |
| Feb 2007 | DoS - htmlFile Blank Object Eval Stress CPU |