This article will demonstrate Microsoft Internet Explorer is vulnerable to XXE up to version 11 on Windows XP and 7. The 0-day vulnerability enables an attacker to exfiltrate arbitrary local files and information across web origins with a malicious web page. We present a proof of concept exploit that reads a local file without user's consent and displays that file content on the webpage. We will provide recommen- dations on how to protect user's data and enforce Same-Origin Policy across different features.