A Danish security researcher warned users of Microsoft's Internet Explorer, Outlook and Outlook Express applications that a recently discovered software flaw could leave their system open to malicious code carried on Web pages or in e-mails. In an advisory released Wednesday, Thor Larholm, a security researcher and partner at risk-assessment company PivX Solutions, warned that HTML objects embedded in Web pages and e-mails could carry code that allows an attacker to check out victims' cookie files, read their documents, and execute programs on their computer. The bug, known as a cross-domain scripting flaw, was discovered on June 25, and information about it has been posted on several security lists since then. Larholm also informed Microsoft of the bug the day it was discovered.

To repair the current problem, Larholm recommended that users disable ActiveX in the security settings for Internet Explorer, or run IE and Outlook in "Restricted" mode, at least until Microsoft releases a patch.
Microsoft said a patch will be available soon.