Microsoft announced Thursday it has patched a major security hole in its flagship Web browser, including old versions for Windows XP--a break from past statements.