Summary

  • W3C treated US Patent 5,838,906 as a possible threat to HTML-based embedded content in 2003 and submitted prior art for re-examination. Its warnings described potential costs, not a count of later broken pages.
  • Microsoft's 2006 Internet Explorer update required users to activate controls on certain pages by clicking or using TAB and ENTER. Microsoft explicitly tied the change to the Eolas case, offered enterprises a temporary compatibility patch, and made the behavior permanent in June 2006. Its April 2008 update disabled “Click to activate.”

The page had loaded; the object was visible. Yet on some sites a reader's first click went to the browser's activation step rather than the control she wanted to use. Nothing in the page explained the patent proceedings behind that gesture. The extra action looked like a small product quirk. Microsoft's own release record gives it a much longer chain of custody.

The dispute was already a web standards problem in 2003. In its FAQ on US Patent 5,838,906, W3C said it had formed a Patent Advisory Group on 23 September to consider effects on HTML-related specifications. It submitted earlier technical work to the US Patent and Trademark Office on 23 October for re-examination. The patent concerned automatically invoking external applications for interactive objects embedded in documents. W3C's original filing argued that a proposed Internet Explorer redesign could disrupt compatibility and require changes to many pages and authoring tools. Those were W3C's warnings during a contested case, not measured outcomes from the 2006 software.

Microsoft supplied the link from case to interface in Security Advisory 912945. Although it later appeared in a security-update distribution cycle, Microsoft described the change itself as non-security. On certain pages, users could interact with ActiveX controls only after activating their interface manually. A mouse click worked; TAB and ENTER worked too. The advisory explicitly said the behavior related to Eolas Technologies and the Regents of the University of California v. Microsoft.

The rollout shows who had to absorb the change. Microsoft released an early Internet Explorer 6 update to MSDN subscribers in January 2006, made it publicly available on MSDN in February, put it on Windows Update as recommended later that month, and included it in the April security update. Some enterprise customers told Microsoft they needed more time for internal applications. On 11 April it offered a compatibility patch that temporarily restored the old ActiveX behavior. The reprieve lasted only until the June update cycle, when the activation change became permanent. The user had an extra step; the enterprise operator had a deadline.

It is tempting to read the gesture as a security consent request. Microsoft's record points elsewhere. A user was not granting a new permission to an unknown program by making the initial click. The browser was changing how an already loaded embedded control became interactive on affected pages. This distinction matters because the later reversal did not announce that a security protection had been withdrawn. It removed a behavior Microsoft had linked to patent litigation.

In Security Bulletin MS08-024, published 8 April 2008, Microsoft listed “Automatic Component Activation” as a functionality change: it disabled the “Click to activate” behavior for ActiveX controls. The bulletin's primary security work concerned a separate vulnerability. It expressly treated the activation change as unrelated to that security fix. The original records here do not establish which private legal development allowed or prompted the reversal, so the documented causal chain ends at Microsoft's two product decisions.

For a reader, the interval was simple: a control that required an extra activation could again work directly after the later update. For developers and enterprise administrators, it was not simple at all. A page could behave differently across rollout phases, a temporary compatibility patch, and a later cumulative update. None of the four records counts affected pages or users; dated compatibility inventories and browser deployment logs would show the scale.

The history sits in a tiny space between display and action. The page did not disappear. The browser inserted a hand-operated checkpoint, then took it away. W3C argued at the standards layer, Microsoft shipped the behavior, and the reader supplied the click.

Original records