Microsoft Internet Explorer CAnchorElement Use After Free

This strike exploits a vulnerability in Microsoft Internet Explorer when handling a maliciously crafted html file. If an html document contains a table tag with a CPhraseElement located withing a table row element but not inside the table body, then an element is created for the tag. If this element is freed later, then all of the children associated with it are also freed. Although, some elements still maintain pointers to memory and any reference or attempt to call these elements will trigger a use after free condition.