The Microsoft HTML Application Host, mshta.exe, runs HTML files with full access to the disk and other privileges. But it is not even HTML4 compliant. I think Microsoft stopped the development of the rendering engine used by mshta.exe at some version of Internet Explorer.
I want to know which version is and, if possible, if there is any hack that allows the rendering engine to be updated with rendering capabilities of newer versions of Internet Explorer.