Category: Malware Delivery
Exploit kits
An exploit kit probes your browser for unpatched flaws. A match lets it install malware without a prompt.
Adobe Flash reached end of support on December 31, 2020. Internet Explorer 11 left support on certain systems in 2022. With those gone, the browser itself is the target. Update promptly and relaunch.
One hacked site or bad ad can reach many visitors. No download prompt is needed.
Updated 2026-10-30
How does an exploit kit work?
MITRE T1189 describes this drive-by pattern. Scripts check your browser and plugin versions. A vulnerable match receives exploit code.
Drive-by downloads are covered in malicious downloads.
- You visit a hacked site or click a malicious ad.
- The page fingerprints your browser and plugins.
- A known flaw triggers the matching exploit.
- The exploit drops malware, often with no prompt.
Are exploit kits still used?
Old plugin targets are gone, but browser exploitation is not. Google flagged seven exploited Chrome flaws by October 30, 2026. Google does not say how its flagged exploits were delivered. See browser zero-day exploits.
CISA's KEV catalog tracks flaws exploited in the wild. Patch those flaws first.
| Component | Support status | What to do |
|---|---|---|
| Adobe Flash Player | End of support on December 31, 2020 | Remove any leftover copies |
| Internet Explorer 11 desktop app | Out of support since June 15, 2022, on certain Windows 10 versions | Use a supported browser |
| Chrome, Edge, and other current browsers | Supported, with regular security fixes | Relaunch when an update waits |
Support status for Flash, Internet Explorer, and current browsers. Sources: Microsoft Flash FAQ, Microsoft IE FAQ, and Chrome Help.
What is a watering hole attack?
A watering hole attack hacks a site targets already trust. MITRE calls this a strategic web compromise. The site then serves exploits to chosen visitors.
Blocking a site your team needs is hard. Fast patching and relaunching matter more.
Why does patching alone fall short?
- Patches take time to reach every device.
- Kits can hide exploit code from scanners.
- Detection often starts after the exploit runs.
- Users rarely see anything happen during the attack.
How do you protect a browser from exploit kits?
- Keep automatic updates on and relaunch when prompted.
- Remove extensions and plugins you do not use.
- Prefer typed addresses over ads for downloads.
- Watch for sudden redirects or unexpected downloads.
- Keep a suspected drive-by plan that includes browser logs.
- Uninstall any leftover Flash Player copies.
Where does browser isolation fit against exploit kits?
- Shield opens a page in an isolated browser off your device.
- Exploit code on that page runs off your device.
- Your own browser still needs every patch.
Limits
- Google's flagged list covers Chrome only.
- Delivery details for flagged exploits are not public.
- Sources were checked on October 30, 2026.
- Legba publishes this guide. Shield is part of Legba's Chrome extension.
What to do next
Patch and relaunch first. Remove what you do not use. Treat isolation as a second layer, not a substitute.
FAQs.
Are exploit kits still a threat?
What is a watering hole attack?
Does patching eliminate the risk?
How does isolation help if the exploit targets the browser?
Can an exploit kit infect a fully patched browser?
Do I need to remove Adobe Flash?
How are exploit kits different from drive-by downloads?
What traffic carries the most risk?
References
- 01
- 02
- 03
- 04
- 05
Keep exploring
- ShieldShield opens a page in an isolated browser off your device.
- All guidesThreats, secure apps, and AI security pages.
- All browser threatsBrowse threats by category and intent.
- Secure apps directorySecure browsing guides for top SaaS apps.
- AI security guidesBrowse guides about AI prompt leakage and prompt injection.
