Microsoft Rolls Out IE6 ActiveX Change

Microsoft this week delivered a long-awaited update for Internet Explorer 6 that changes the way the browser loads embedded ActiveX control. The modification comes as part of an ongoing patent dispute with Eolas Technology and the University of California.

The patent specifically involves the mechanisms used to embed interactive programs in a Web browser. Eolas successfully sued Microsoft in 2003 alleging IE's plug-in architecture infringed on its patent, and was awarded $521 million in damages, which has ballooned to $560 million due to interest.

In response, Microsoft said it would alter how the browser implemented ActiveX, but later backed away from the switch. Software affected by the patent would include Macromedia Flash, QuickTime, RealOne Player, Acrobat Reader, Sun's Java Virtual Machine, and Windows Media Player among other applications that embed into Web pages.

But following two legal setbacks in its efforts to invalidate the Eolas patent and have the ruling appealed, Microsoft said in December it would go ahead with the update.

In September, the U.S. Patent and Trademark Office upheld the patent despite claims of prior art. In late October, the U.S. Supreme Court refused to hear an appeal regarding the damages awarded to Eolas.

Microsoft is still planning to appeal the verdict on another legal front, but has opted not to wait for that outcome before changing ActiveX. The company says it will roll out the update to Internet Explorer 6 in phases.

The update -- available for Windows XP and Windows 2003 -- is currently available as an optional download from the Microsoft Download Center and Windows Update. Microsoft said it expects the majority of IE users to download the patch as part of their security updates over the next four to six months.

It's not clear if and when the company will issue an update for Windows 2000 users. Internet Explorer 7 for Windows XP and Windows Vista will include the change as well.

With the update, ActiveX controls will no longer be activated by default. This means users must first click on the control before it will recognize any input. However, Microsoft has posted instructions on how developers can bypass this restriction through the use of external scripts.

ActiveX controls that do not require interaction will continue to perform as they always have, Microsoft says. The change will likely have little effect on end-users, but may require minor updates to accessibility software that must now recognize an activate controls before taking action.

Microsoft has posted a security advisory containing more details on the change.