This is my understanding of the problem, but I'm not a security guy so please correct me where I'm wrong. The rub is that IE8 modifies the source of a page to

This is my understanding of the problem, but I'm not a security guy so please correct me where I'm wrong. The rub is that IE8 modifies the source of a page to prevent XSS attacks. Essentially it escapes a bunch of strings, like <script> tags. Sanitization like this is common to sites which allow UGC, with the onus being on the programmer to perform the sanitization. Unfortunately, a lot of popular UGC sites either attempt no sanitization, or screw it up (e.g., Twitter, MySpace). Thus, IE8 attempts basic sanitization of all pages automatically, unless a header is sent telling it not to. In theory, this should provide basic protection for the user when the site's developers drop the ball. Long story short, there is an error in their sanitization routine. Thus, an attacker can pass a seemingly harmless string (which would not be filtered by the application's own security), which is then escaped by IE8, producing malicious output. This type of bug is somewhat common, but since many dev's are rolling their own sanitization routines (bad idea [1]), the exposure is usually limited to one site. But because IE8's filter runs on all sites, any site which contains the malicious string is affected. Given the huge number of sites that allow some kind of UGC, this is a huge problem. Reddit's recent worm is somewhat analogous, in that its a case of a well-intentioned sanitization method being exploited. Their post mortem illuminates what a complex problem this is: http://blog.reddit.com/2009/09/we-had-some-bugs-and-it-hurt-us.html http://blog.reddit.com/2009/09/we-had-some-bugs-and-it-hurt-... Hope that was helpful. [1] Note: In a similar vein, Mr. Ptacek and Mr. Lawson have decried rolling your own cryptography solution, and instead advocate using a battle tested solution like Keyczar. This is great advice, and should also be applied to sanitization methods.