Once a month is too long. If MS were to keep on top of these flaws, they should investigate and fix them as soon as they are found, then release them as soon as testing is complete.

It is just unacceptable.

It's not rated as highlly Critical though,  And as long as no active attack is underway they don't have to rush a patch out.  By contrast, the last critical bug had a patch out in a few days,  I beleave it was the XML flaw for IE6?  Though that also didn't effect IE7 since it was already fixed in the new version.   But the point is,  if it's a problem that needs fixing fast, they'll break the one month patch cycle and release it, as they have done before.

I think this vulnerability is critical! A malicious website could retreive information from a website where you are logged in (your hotmail mailbox for example).

With tabs, i sometime have several websites opened at the same time.

Saying that there are no known attacks is bullshit. Do you think that pirates contact Microsoft to tell them : "Hey, my website is malicious !"

How can MS communicate on the new security features with that kind of hole ?

What a shame!