Researchers at an HP security division have publicly detailed four code-execution vulnerabilities that can be used to hijack end-user smartphones running the latest versions of Microsoft's Internet Explorer browser.

The disclosures earlier this week came more than six months after researchers from HP-owned TippingPoint first privately reported the bugs to Microsoft security engineers. According to the advisories published here, here, here, and here, Microsoft officials acknowledged the bugs and in each case asked for an extension beyond the four months TippingPoint officials normally wait before publicly disclosing vulnerabilities. All four of the extensions expired Sunday, leading to the public disclosure of the bugs.

It remains unclear why Microsoft hasn't issued fixes. TippingPoint alerted Microsoft to three of the vulnerabilities in January and one of them last November. A Microsoft spokesman told Ars he was looking in to the matter.

Update:Microsoft has issued a statement that says: "We're aware of the reports regarding Internet Explorer for Windows Phone. A number of factors would need to come into play, and no attacks have been reported. We continue to monitor the situation and will take appropriate steps to protect our customers."

All four of the bugs allow attackers to remotely execute malicious code on end-user mobile devices when they use fully patched versions of IE to visit booby-trapped websites. The bug reported in November also includes a version of IE that runs on Windows Phone.

"The vulnerability relates to how Internet Explorer processes arrays representing cells in HTML tables," the corresponding TippingPoint advisory explained. "By manipulating a document's elements an attacker can force a Internet Explorer to use memory past the end of an array of HTML cells. An attacker can leverage this vulnerability to execute code under the context of the current process."

The vulnerability came to light at the TippingPoint-sponsored Mobile Pwn2Own hacking contest in November. During the multiday event, an HP official reported an attack exploiting IE on Windows Phone was able to steal sensitive browser cookie files but didn't manage to pierce its security sandbox. The exploit was developed by Pwn2Own contestant Nicolas Joly, who was working with Vupen, a France-based seller of exploits.

Further Reading Hacking Team’s Flash 0-day: Potent enough to infect actual Chrome user

The three other IE vulnerabilities also allow attackers to execute code "under the context of the current process." That may mean the exploits are similarly unable to break the IE sandbox, which is designed to isolate Internet content from sensitive operating-system functions. Still, even when such exploits suffer this limitation, they can often be combined with separate privilege-escalation attacks that make it possible to break free of the sandbox. A recent exploit marketed by Italian malware-as-a-service provider was able to bypass the heavily fortified defenses of Google's Chrome browser. In the past two weeks, Microsoft has patched two privilege-escalation bugs in Windows that came to light following the recent security breach of Hacking Team. Microsoft also recently fixed a separate IE vulnerability that came to light in the breach.

It's possible that Microsoft engineers assigned a higher priority to the vulnerabilities exposed in the Hacking Team breach and at the last minute decided to hold back the IE vulnerabilities disclosed by TippingPoint. Those three bugs involve the handling of CAttrArray objects, CCurrentStyle objects, and CTreePos objects. With those details now public, it wouldn't be surprising if attackers develop attacks that actively exploit the critical bugs. If possible, readers should avoid using IE, at least until Microsoft issues public guidance on the TippingPoint disclosures.

This post was updated to reflect information later provided by TippingPoint that the vulnerabilities affect only the mobile versions of Internet Explorer. Desktop versions aren't vulnerable.