Actually, ie is still vulnerable to a very similar attack in some cases, specifically you can leak responses containing small json array by inlining the json as a script[src=vbscript] tag. Disclosed here: http://en.wooyun.org/bugs/wooyun-2013-023
with the status "unable to contact the vendor or actively neglected by the vendor" :-/
Edit: I meant "injecting" not inlining. Thanks chc for pointing that out.
with the status "unable to contact the vendor or actively neglected by the vendor" :-/
Edit: I meant "injecting" not inlining. Thanks chc for pointing that out.