Microsoft stated today that it has replaced the decades-old JScript runtime with JScript9Legacy as the default scripting engine in Windows 11 24H2 and later versions like 25H2. According to the business, the "enhanced speed and security capabilities the new JScriptLegacy scripting engine delivers" will now be available to Windows 11 customers.
Microsoft claims that by moving to JScript9Legacy, it hopes to lessen vulnerabilities associated with legacy scripting, such as cross-site scripting (XSS), among others. Cybercriminals can employ XSS attacks to add malicious code to trustworthy websites, which then causes the code to run when a potential victim loads the website.
Windows has previously demonstrated its susceptibility to scripting engine assaults. Microsoft released remedies for a remote code execution vulnerability under CVE-2024-38178 as recently as August 2024. Furthermore, the internet can be risky, particularly for inexperienced Windows users.
Stricter execution guidelines and enhanced object handling are enforced by the new JScript9Legacy engine, which should lessen the impact of XSS-like assaults. Simply put, this modification should assist defend against web-based threats that take advantage of out-of-date script engines for both home users and businesses.
If you remember, Microsoft changed Edge's default Enhanced Security setting in a similar way.
For those who might not know, JScript was first introduced with Internet Explorer 3.0 and has been the foundation of Windows scripting since the late 1990s. It is widely used due to its compatibility with a wide variety of web content, but it also exposes thousands of systems to contemporary attack methods.
Microsoft claims that the new engine replaces JScript.dll with JScript9Legacy.dll. The change is intended to provide more robust security on the most recent version of Windows while preserving backward compatibility for older scripts. For the majority of users, no more effort is necessary because Microsoft states that "no additional action is required from you to benefit from JScript9Legacy, nor will it harm existing processes."
The announcement post is available on Microsoft's Tech Community website here.