Resident Script via WebSlice XAML Frame

A setInterval placed inside a XAML Frame element (loaded via a WebSlice) keeps running even after the WebSlice is closed, because the PresentationHost.exe process remains resident in memory. The trick to making the window reference survive is to briefly open and close a popup — the opened window’s opener then holds a live reference to the XAML Frame’s window object.

<span class="hslice" id="oSlice">
    <span class="entry-title">XAML FRAME</span>
    <a rel="entry-content" href="xamlframe.xaml"></a>
</span>

The XAML file (xamlframe.xaml) contains a Frame element that loads a small HTML page with the setInterval. Once the user adds the WebSlice and clicks it, the alert fires every few seconds even after closing the slice — the task appears as “Message from webpage” in the taskbar, sourced from PresentationHost.exe. Note: on Vista with later PresentationHost patches, the alert method was blocked inside XAML Frames as a functionality fix; the resident interval still runs, it just cannot surface a visible alert without disabling Protected Mode.

Without Vista Explanation

This sub-folder contains a stripped version of the same PoC without the Vista-specific notes, for cleaner testing on XP.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.