46

I have disabled Internet Explorer in the "Windows Features" dialog. Nonetheless Windows Update alerts me that there are security updates for IE.

I am aware that I cannot uninstall IE and it remains on my system. Are there any security issues if I do not install the available updates or can I discard all the updates for IE?

Improve this question
4
  • 22
    Yes; You should update IE even if its been disabled. Yes; There are security concerns if you don't.
    – Ramhound
    Commented May 2, 2014 at 18:50
  • 5
    The real question is why SHOULDN'T you install the update? Does it interfere with an application you need to use? Otherwise, if it makes your computer safer...
    – WernerCD
    Commented May 2, 2014 at 22:15
  • 7
    Some games/applications may use the system browser engine (IE on Win) for background tasks, or as a "skinned" browser. Steam formerly, for example. For this reason, updates to the browser are always a good idea. Just to add, you can delete IE, but it's hacky :)
    – Jongosi
    Commented May 2, 2014 at 22:44
  • 1
    Be aware that disabling IE may affect other software. I've learned that the hard way after wasting a couple of hours trying to install Corel Draw. The installer uses IE to display the EULA.
    – Dennis
    Commented May 4, 2014 at 16:42

4 Answers 4

Reset to default
38

An operating system is like a table.

A browser or other application is like an item on top of the table.

Internet Explorer is an application, but it's PHYSICALLY part of the table because of how Microsoft bundled it with the OS.

Even if you don't use IE you really need to install updates. If a hacker gains entry to your system, they may attempt to abuse a known vulnerability that you could have patched but didn't and then your problem is compounded. Additionally, since IE is a shell used by some other browsers (and other applications), if you're using one of those tertiary browsers (such as Maxathon) you would be stuck with an older version of IE that renders the pages (even though the interface is something else).

When dealing with vulnerabilities, you need to do a cost/benefit analysis; does the cost of the downtime to install, and any compatibility problems it produces, outweigh the risk or loss incurred from an attack?

Improve this answer
8
  • 15
    First off, saying Microsoft's integration of IE is an anti-competitive practice is a bit much without a reference. There are some very good reasons to include a browser with the OS - at minimum, it provides a known browser/HTML reader that can be referenced by other programs (with certain minimum features, too). This culminates in companies writing applications as plugins for (older) versions of IE, as it was a common deployment environment (hopefully, this practice is on its way out). ALL applications have known "ignored" vulnerabilities, including Chrome, Firefox, etc.
    – Clockwork-Muse
    Commented May 2, 2014 at 23:41
  • 5
    @Clockwork-Muse References: United States v. Microsoft Corp, European Commission Statement of Objections.
    – David Richerby
    Commented May 3, 2014 at 13:00
  • 1
    @DavidRicherby - At least some of the anti-competitive part was due to marketing and related non-technical tactics. It's possible that the initial integrating bundling was performed for purely technical reasons, or at least altruistic ones; among other things, it did add what was becoming an essential feature to the OS, for people who may not have the technical expertise to install/download one.
    – Clockwork-Muse
    Commented May 3, 2014 at 13:30
  • 1
    If a hacker has access to your system out-of-date IE patches are the least of your problems. Why bother exploiting IE bugs when I can just run any program I like?
    – Casey
    Commented May 4, 2014 at 5:55
  • The only scenario I can see if an escalation of privilege issue, but that really needs to get patched at the OS level or else what's stopping me from running my own program that has the same "flaw" as IE (not a flaw to me in this scenario)?
    – Casey
    Commented May 4, 2014 at 5:59
20

Other things use Internet Explorer that you may not be aware of, so if there are security updates for IE you should install them.

Other applications use scripts and pieces of the IE application.

I don't know exactly how it works, but yes you should install the IE updates.

Improve this answer
15

You should always install updates for Internet Explorer, even if you're using a different browser.

Internet Explorer is very tightly woven into the fabric of Windows. For example, Internet Explorer's proxy settings, the hosts file and Windows Firewall are examples of parts of Windows that are intertwined with Internet Explorer. A vulnerability here puts your whole system at risk.

Additionally, as you can't uninstall Internet Explorer, it can run and make your system vulnerable. You don't know when it will run. For example, if you're viewing a Help file (.chm), Internet Explorer is rendering the page for you. Some browsers and other applications use Internet Explorer under the covers to render rich content. Again, a vulnerability here puts your whole system at risk.

Improve this answer
11

I would absolutely suggest installing the update. IE is rather tightly coupled with the operating system and parts and pieces can be used by a surprising variety of applications. Even if you're not browsing with it on a daily basis, it's still on your system and is still a security hole.

More importantly, what's the risk/return on not doing it? The value of not doing it is not having to restart the machine. Meanwhile, if IE accidentally gets launched or is used without you being aware, it puts you at risk.

Just because you don't plan to use one of the pockets in your pants, if they have a hole, you should still patch them!

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .