Microsoft on Friday said that both Internet Explorer 10 and itspredecessor, IE9, contained an unpatched vulnerability, but that hackerswere currently exploiting only the newest, IE10.