What can an attacker do with an exploited program?

Question

If you find an exploit in say, Internet Explorer, what would a program utilizing that exploit be able to do?

Would it be able to only change data in Internet Explorer, could it modify anything on disk, or could it modify only files that IE would be able to?

Answer 1

I think your question is much broader than you realize, but I'll try to give some sort of answer.

If you find an exploit in say, Internet Explorer, what would a program utilizing that exploit be able to do?

I don't know, depends on what the exploit is. The most dangerous kind of exploit that an application can have is called arbitrary code execution where an attacker can get the application to execute code that the attacker wrote. Think about this like the attacker is re-writing the code of internet explorer while it's running; they are literally turning IE into malware.

Would it be able to only change data in Internet Explorer, could it modify anything on disk, or could it modify only files that IE would be able to?

You basically just answered your own question. Yes, the attacker could get IE to do anything that a program is capable of doing - reading / writing files, sending stuff over the internet, making operating system calls (exploiting OS vulnerabilities if there are any), planting other malware and executing it, possibly modifying the registry, etc.

Since browsers are the most visible attack surface on an end-user's computer (it's the application that actually makes contact with malicious web sites), more and more browsers are running themselves in a sandbox so that if something malicious does get in, the damage it can do is minimal. Here's a nice article by How-To-Geek talking about sandboxes for your apps.