Continuing a years-long push to phase out its insecure legacy technologies, Microsoft has announced a new milestone for VBScript. This month, it will disable VBScript by default in Internet Explorer 11 running under Windows 7, 8, and 8.1.
“The change to disable VBScript will take effect in the upcoming cumulative updates for Windows 7, 8, and 8.1 on August 13, 2019,” the Microsoft Edge team revealed. “VBScript will be disabled by default for Internet Explorer 11 and [web browser controls] for Internet and Untrusted zones on all platforms running Internet Explorer 11. This change is effective for Internet Explorer 11 on Windows 10 as of the July 9th, 2019 cumulative updates.”
VBScript was also used for writing scripts—basically more modern versions of MS-DOS batch files—that ran under the Windows Scripting Host (WSH) starting in Windows 95 (later renamed Windows Script Host). And it was briefly used as a scripting language in just one Microsoft Office application, Outlook 97. It was even used in Windows CE.
But by the turn of the century, Microsoft was transitioning to .NET and VBScript was left behind. Microsoft transitioned Office to Visual Basic for Applications (VBA), it utilized Visual Basic .NET for both client- and server-side development, and it eventually replaced WSH with PowerShell. By the 2010s, Microsoft explained that VBScript was deprecated and “should no longer be used as a scripting language.” It was only permitted for websites rendered in legacy document modes, and then only in IE 11.
In 2017, Microsoft released a cumulative update for Windows 10 that included an option for blocking VBScript execution in IE 11 for all document modes. And it noted that it would disable VBScript entirely in some future update. That day has arrived: Microsoft disabled VBScript by default in IE 11 on Windows 10 in July, and it is doing so today on all remaining supported Windows versions.
“Should you still need to utilize this legacy scripting language, the settings to enable or disable for VBScript execution in Internet Explorer 11 will remain configurable per site security zone, via Registry, or via Group Policy,” Microsoft notes.
Normally, I would assume that once IE 11 is no longer supported, Microsoft would officially kill VBScript for good. But IE 11 will be supported for the supported life of Windows 10, which is currently indefinite. I assume that will have to change at some point. But for now, VBScript continues forward, albeit in dramatically diminished form.