The Web Page As Desktop App
browser wars 1999 deadOne tag in the head turned a web page into a trusted Windows program with full read and write access to your files and registry.
In 2026: Dead in the browser, undead on the disk. An .hta file opened by mshta.exe ran outside all web security, which is exactly why malware loves the format and why mshta.exe still ships in Windows 11. In a browser the hta:application tag is just unknown markup, so the page below renders as an ordinary paragraph with none of the powers it declares.
Where it came from: Microsoft HTML Applications, Internet Explorer 5, 1999. mshta.exe still ships in Windows 11. Wikipedia ↗
<html>
<head>
<title>My Utility</title>
<!-- This one tag, in a .hta file, meant NO web sandbox at all -->
<hta:application
id="app"
applicationname="MyUtility"
border="thin"
scroll="no"
singleinstance="yes" />
</head>
<body>
<p>Saved as .hta and double-clicked, this had your whole filesystem.
Loaded in a browser, it is a paragraph.</p>
</body>
</html>