SEARCH

How-To Geek

How to Crash Any Version of Internet Explorer with Simple HTML

image

We’ve already shown you why so many geeks hate Internet Explorer, and since it’s almost Halloween we figured we’d show you something really scary—how to crash any version of Internet Explorer with nothing more than HTML and CSS.

Note: we’re really not trying to bash on Internet Explorer—in fact, the latest beta version is really quite nice, but we figured we’d have some fun with this bug, and maybe somebody at Microsoft will fix this problem before the final release.

How to Crash Internet Explorer with HTML

Simply open up notepad or another text editor, paste in the following, and save it as SomeFilename.html.

<html><head>
<style type="text/css">
#a {
        margin:0 10px 10px;
}

#b {
        width:100%;
}

</style>
<title>IE Crasher</title>
</head>
<body>
<table><tr><td>
<div id="a">
<form id="b">
<input type="text" name="test"/>
</div>
</td><td width="1"></td></tr></table>
</body></html>

It should end up looking something like this:

image

Then open it up in Internet Explorer, and BOOM! IE is dead.

Note: hilariously, when I originally put this HTML code into the article, it actually crashed Windows Live Writer repeatedly. Finally had to login to WordPress and remove the code from there in order to be able to even open up the post again.

Where Does This Work?

We’ve tested this out, and it seems to crash just about every single version of IE, from IE6 even up to the latest Internet Explorer 9 platform preview that was released earlier today.

image

Credits

It’s at this point that we should point out that we didn’t figure this out—in fact, there’s a web site that you can visit that will crash IE, and we got the source code from that site.

DO NOT CLICK THIS OR YOUR BROWSER WILL CRASH –> crashie8.com

Please share this link responsibly.

Lowell Heddings, better known online as the How-To Geek, spends all his free time bringing you fresh geekery on a daily basis. You can follow him on if you'd like.

  • Published 10/29/10

Comments (43)

  1. Miguel

    The page you mentioned DID NOT crash my session of IE8, I have a screen shot to prove it …

  2. The Geek

    It definitely crashed on my Windows 7 virtual machine.

  3. Gouthaman Karunakaran

    @Miguel

    Why don’t you post a link to the screenshot? It’ll be nice to see the proof.

  4. Miguel

    A small mistake, it was IE 7.0, not 8.0 … I tested more, results:

    – Windows Server 2003 + IE 7.0, it DOES NOT crash.
    – On my desktop, Windows Vista + IE 7.0, it does crash.
    – It did not crash my iPad
    – It did not crash Opera mini in my iPhone :)

    Thanks,
    Miguel

  5. ankit

    nice post…. but u dont need this because internet explorer crashes every time with or without script.. :)

  6. Miguel

    More interesting facts:

    – In Windows Server 2003, if I click the link in the article, it does not crash. If I type the url and press enter IT DOES crash.

    – The previous excersice crashed my Vista desktop IE session regardless of how I go to the page.

    This is the link to the screen shot:

    http://www.flickr.com/photos/55247975@N03/5124693339/

    Thanks,
    Miguel

  7. Grant

    HAHA! What if you set this as someone’s IE8 homepage?? Good way to get them to switch to Firefox! Very evil, though. :)

  8. megablue

    I have another piece of malformed HTML code that can crash any version Internet Explorer browser :D

  9. jon_hill987

    It also crashes Firefox 3.6 if you load it with IETab.

    :)

  10. Ahmad Alfy

    WTF It crashed my IE8 on Vista Business
    WTF SERIOUSLY

  11. Asgaro

    lol @ Grant :D

  12. Aethec

    This is malformed HTML – no way someone would write that to do something else than crash IE ;-)
    Interesting, though.

  13. red ronin

    Cool, but. Is there any explanation WHY this happens? Inners of IE are the results that ok, but what inners?

  14. Hatryst

    Best prank ever… Set it as someone’s IE homepage :D

  15. maximx86

    It crashed IE9beta either…

  16. Beta

    Good one @Grnat
    and another funny thing about IE from the Geeks

  17. RSVR85

    +1 for Grant!

    I’m using the IE9 PP6 and this didn’t crash IE either by clicking the link or manually entering it.
    Only after IE9 attempted to recover the page (as it was unresponsive) did it bring the entire browser down requiring a forcible termination.

    An explanation as to why this happens would be nice to see also. =]

  18. wstn

    Its kinda unfair to call this a ‘bug’, its HTML that effectively does nothing, look at it in a different browser and you will see what i mean, basically your coding HTML specifically to crash the browser thanks to the way trident renders HTML – its more of an ‘attack’ and its something that you would never stumble across ‘by accident’ only if someone is trying to crash your IE.

  19. The Geek

    It seems to depend on the size of your IE window – I had it work fine once or twice on IE6 until I resized the window.

  20. IES

    Aha! I just love when IE crashed, it just threw me some nasty – stupid error messages, rofl, i’m gonna put this as a homepage of my IE-lover group *evil-grin*

  21. mousse

    Well, you put wrong HTML code, with missing tags.. (and no sense: a table column with margins larger than cell width) just like to write a division by zero in a C program and claim that the program gives an error!

  22. Sepehr

    If they change your homepage, you can change it from the control panel.

  23. Pinakin Tamboli

    Don’t Make people foolish

    You have some error in the script so please resolve it before running on IE.

    Your HTML scripting is very weak because there is no ending tag for <Form

    so my friend please if you want my help please resolve it & then publish on this giant Internet.

    I have also error message : Validation (XHTML 1.0 Transitional): Element 'form' is missing its closing tag"

    So dear solve it first

  24. Ken

    >>>This is malformed HTML – no way someone would write that to do something else than crash IE ;-)

    This is precisely the reason why Microsoft need to get their act together. By not parsing input given to it in a responsible manner it is possible for baddies to exploit this in a similar way to the buffer overflows and cross scripting errors that we have come to expect from improperly thought out software.

    The reason this is not done is probably speed. It takes time to process input properly. We’ve heard before about how MS is going to put Security before Speed. This is a demonstration of how corners are still being cut.

  25. Wander

    I feel tempted to put this piece of html on every website i make

  26. Tangmeister

    Alright, well, you’re right.

    I snapped my IE9 beta (without refresh) to the right of the screen, and it just kept loading. I then noticed it said the page was not responding via the VERY VERY VERY unobtrusive (or unnoticed) info bar at hte bottom of the page.

    I refreshed and lo and behold, it loaded.

    I then dragged it out to see the whole thing, and it froze. XD

  27. Terry Hollett

    Didn’t crash IE7 on my XP system but it did freeze up. I opened task manager and it using 98% of the cpu. In Opera 10.63 it displays a rectangular, like a search bar. I can type into it.

  28. Miguel

    Regardless if the code is malformed or not, if this was intentional or not, this should not crash or hang any browser.

    I use IE 9 at home and IE 7 at work (as you saw) I do not use any other browser, just Safari with IE 9 does not render a page properly but well is still in Beta. I still can not defend IE on this one, this IS a bug and it should be corrected.

    If a beginner in HTML makes a mistake like this one, try to image how difficult will it be to debug if the browser just crashes or hangs.

  29. rino

    well it crashed IE8 on win7 32bit. i copied the code and created a local .htm file for IE8 to open it.

    for firefox just an empty box appears at the upper left corner of the window. still there in my other Tab as i write this.

    to the person using IEtab, of course it’ll crashed coz you are opening IE within firefox. it’s not firefox itself that crashed. and please stop using IEtab.

  30. johnnyq3

    I ran valitation on the code above and the code doesn’t conform to W3C standards.

  31. Aethec

    Ken:
    >> By not parsing input given to it in a responsible manner it is possible for baddies to exploit this in a >> similar way to the buffer overflows and cross scripting errors that we have come to expect from
    >> improperly thought out software.

    If you think this can lead to code execution, you’ll have to write a PoC to prove it. And bypass the sandbox, too.
    As long as this is only a crash using malformed HTML, it can only be used by people who actually want IE users to crash their browsers.
    I’m not saying it isn’t the IEteam’s fault – there’s clearly something wrong here – but it has way less impact than an actual security flaw.

  32. Jack O'Lantern

    It doesn’t work. Nothing crashes. Could it be my browser addon’s? Maybe it’s my proxy server or possibly even one of my two anti virus engines that’s saving me.

    Oh wait! That’s right, I’M USING FIREFOX!

    All kidding aside, one thing I learned long ago was to NEVER TRUST MICROSOFT! At least don’t trust them any more necessary. And with that said, I have to wonder just how well Microsoft Security Essentials is working for me or even just how immune Windows 7 is to these so called “threats.” In this case, this bit of code was just a harmless demo by some white hat crackers apparently wanting to get us to THINK! But it also has me wondering just what the black hats are up to. (Get scared. Get VERY scared. After all, it’s Halloween!)

  33. `gene

    As long as the window is narrower then 756px it won’t crash IE, widen the window further and Bam! Dead! Defiantly worthy of being IE’s homepage.

  34. Hugh Jorgen

    IE. Inbreed Exploiter. Yeah, that pretty much covers it.

  35. G-GeeK

    Yea it works,it crashed ie9 beta.

  36. Niphoet

    Any idea on how to insert this into a wordpress blog??

  37. Mike

    How would you actually set that as a homepage?

  38. salam

    can you explaine how this code worked and crash the IE I underastand the code but i don’t know why the IE crashed

  39. Pavan

    Awesome :-D ie you rock on the negative axis… Nothin went rong in chrome or ff !! My ie crashed in windows and linux !! World’s worst browser = IE !! Any1 e1 now argues that ie rocks must be super smart !! :-P

  40. Urabewe

    Jack O’ Lantern,

    Running more than one anti-virus is doing nothing for you but slowing down your PC. I won’t go into detail, you can Google it and find all kinds of information as to why it is a bad idea.

    Personally I use Linux so no need for anti-virus. Linux has gotten much easier to use I suggest at least trying out a Live CD of Ubuntu or Mint and give yourself a few days to get used to it. It is new so it will take some getting used to, once that happens you will see how much easier, more stable and more secure Linux is than Windows. If you need Windows do a dual boot system.

    I would consider this code to be an exploit. Using malformed HTML/CSS to exploit a rendering bug in IE. I don’t think there is any way to execute any code by using this exploit. This is just an exploit to crash the browser not much else can be done.

    It seems like the exploit only works when the whole page is displayed inside of IE. If you have the window small enough to not render the whole page at once then it doesn’t crash, once you expand the window, IE now is rendering the whole page in the window all at once which causes the crash.

  41. jon

    The script doesn’t crash my ie, but the link given does!

  42. anonymous

    LOL! :D IE9 can still crash using not much code. I cannot believe that simple code would crash IE9 as well.

    It crashed mine the first time but somehow IE9 learnt how to block this website. They should fix this bug and view the website as well, like other web browser do.

    I don’t use IE9 but Google Chrome instead.

  43. Abhay MIttal

    Sorry, but I’ve crashed my Internet Explorer. Or I don’t know I’ve done or not. As I was working on Firefox while clicking that link. Is that for one time only? Will I be able to use IE again by restarting it?

Enter Your Email Here to Get Access for Free:

Go check your email!