Microsoft said Thursday it would issue an RC (release candidate) for IE8 (Internet Explorer 8) in the first three months of 2009, indicating it will ship its newest browser sometime in the first half of the year.

"We will release one more public update of IE8 in the first quarter of 2009, and then follow that up with the final release," Dean Hachamovitch, the general manager overseeing IE8, said in an entry to a company blog.

[ Find out J. Peter Bruzzese's take on IE8 in his Enterprise Windows blog: "IE8 pushes back Firefox and Chrome even further" | Discover the top-rated IT products as rated by the InfoWorld Test Center. ]

The current version is Beta 2, which was released in late August.

If Microsoft's past performance is an indicator, the final of IE should launch in the first half of 2009. Its last major update, IE7, hit release candidate status in late August 2006, and shipped as a final version in mid-October of that year, a span of just under two months. Even if Microsoft pushes the release candidate of IE8 to users in March 2009, it should still be able to manage to ship a final edition by the end of June.

Hachamovitch said the IE8 release candidate would be the final, more or less. "We want the technical community of people and organizations interested in Web browsers to take this [release candidate] update as a strong signal that IE8 is effectively complete and done. They should expect the final product to behave as this update does." He went on to urge site and Web service developers to test their work against the release candidate when it ships.

As other Microsoft officials have done since IE8 first appeared, Hachamovitch declined to set a specific date, however. "Our plan is to deliver the final product after listening for feedback about critical issues," he said. Previously, all that the company would commit to was a release prior to the launch of Windows 7, which in turn has been pegged for late 2009 or even early 2010.

Although several people who left comments on Hachomovitch's blog applauded the disclosure of the rough timeline, others thought Microsoft is moving too fast.

"'We listen,' 'We are listening,' 'We've heard you,' and other stupid marketing sentences..., you've just heard nobody," said a user identified only as Oliver. "Where's beta3? Beta2 was unusable and crashed all the time, so we can't test it. Please give us a testable beta before a release candidate."

"This has been said many times before, so I'll make it simple," added Jason Ashdown in another comment to the post. "We want a Beta 3! Beta 2 was nowhere near the quality we expected. Before getting to a [Release Candidate], we want to get the last set of bugs reports before you get to RC1. Closing the door now would be a horrible mistake."

Although IE continues to dominate the browser market, relatively few people are trying the preliminary versions of IE8, according to Web metrics firm Net Applications Inc. IE8 accounted for just 0.58 percent of all browsers used last month, Net Applications reported. As a comparison, Google's Chrome, which was released about a week after IE8 Beta 2, and is in beta testing itself, accounted for 0.78 percent of the browsers used in October.

Computerworld is an InfoWorld affiliate.

An Austrian security vendor has found a vulnerability in Windows Vista that it says could possibly allow an attacker to run unauthorized code on a PC.

The problem is rooted in the Device IO Control, which handles internal device communication. Researchers at Phion have found two different ways to cause a buffer overflow that could corrupt the memory of the operating system's kernel.

[ Discover the top-rated IT products as rated by the InfoWorld Test Center. ]

In one of the scenarios, a person would already have to have administrative rights to the PC. In general, vulnerabilities that require that level of access somewhat undermine the risk since the attacker already has permission to use to the PC.

But it may be possible to trigger the buffer overflow without administrative rights, said Thomas Unterleitner, Phion's director of endpoint security software.

The vulnerability could allow a hacker to install a rootkit, a small piece of malicious software that is very difficult to detect and remove from a computer, Unterleitner said.

Phion notified Microsoft about the problem on Oct. 22. Microsoft indicated to Phion that it would issue a patch with Vista's next service pack. Microsoft released a beta version of Vista's second service pack  to testers last month. Vista's Service Pack 2 is due for release by June 2009.

Unterleitner said there has been lots of interest in the vulnerability. "We have received requests for detailed information on how to take advantage of this exploit from all over the world," he said.

Microsoft officials contacted in London did not have an immediate comment.