Microsoft announced Thursday it has patched a major security hole in its flagship Web browser, including old versions for Windows XP – a break from past statements.