PRB: Cannot Retrieve Top-Level IWebBrowser2 Interface from a .NET UserControl

Previously, you could retrieve the top-level IWebBrowser2 reference in the SetClientSite method of the IOleObject interface as follows:

1. Call the QueryInterface method on the client site for the IServiceProvider interface.
2. Call the QueryService method for IID_IServiceProvider under the SID_STopLevelBrowser service.
3. From the second IServiceProvider, call QueryService for IID_IWebBrowser2 in the SID_SWebBrowserApp service.

However, you cannot retrieve the top-level IWebBrowser2 interface from a default UserControl object.

IWebBrowser2 and the other interfaces that the browser exposes are unmanaged functions. You must have unmanaged code permission to call unmanaged functions. You are not granted this permission by default for controls that run in the browser because this requires a high level of trust.

Once someone has unmanaged code permission, that person can do potentially anything that he or she wants from the control. By design, UserControl objects cannot access vulnerable information in a client's computer, and UserControl objects do not need to access this information to function.

To retrieve the IWebBrowser2 interface and use it from within an UserControl object, you must include a managed wrapper around IWebBrowser2 that is safe to call from controls that run in the browser. Microsoft does not currently have any wrapper classes available to accomplish this task.

This behavior is by design.

For additional information, click the article number below to view the article in the Microsoft Knowledge Base: For more information about developing Web-based solutions for Microsoft Internet Explorer, visit the following Microsoft Web sites: