Considering that Vista saw a concerted push to move as much stuff as possible
out of the kernel for security reasons, to the point that Internet Explorer runs at the lowest possible Integrity level, even lower than a non-Admin user... no, I don't think exploiting IE is going to get you into the kernel
Have you read up on Windows Integrity Control? Seriously, take ten minutes and read both pages of this article.
http://www.securityfocus.com/infocus/1887 Snip:
- Untrusted ? processes that are logged on anonymously are automatically designated as Untrusted
- Low ? The Low integrity level is the level used by default for interaction with the Internet. As long as Internet Explorer is run in its default state, Protected Mode, all files and processes associated with it are assigned the Low integrity level. Some folders, such as the Temporary Internet Folder, are also assigned the Low integrity level by default.
- Medium ? Medium is the context that most objects will run in. Standard users receive the Medium integrity level, and any object not explicitly designated with a lower or higher integrity level is Medium by default.
- High ? Administrators are granted the High integrity level. This ensures that Administrators are capable of interacting with and modifying objects assigned Medium or Low integrity levels, but can also act on other objects with a High integrity level, which standard users can not do.
- System ? As the name implies, the System integrity level is reserved for the system. The Windows kernel and core services are granted the System integrity level. Being even higher than the High integrity level of Administrators protects these core functions from being affected or compromised even by Administrators.
- Installer ? The Installer integrity level is a special case and is the highest of all integrity levels. By virtue of being equal to or higher than all other WIC integrity levels, objects assigned the Installer integrity level are also able to uninstall all other objects.
As you can see, IE is running about as far below the kernel's Integrity level as you can get a local process. If people disable UAC and therefore disable Protected Mode, then IE will be running at whatever level the user is at, like other browsers, but certainly not as SYSTEM.
Another good explaination
here. Snip:
In IE7?s Protected Mode?which is the default in other than the Trusted security zone?the IE process runs with Low rights, even if the logged-in user is an administrator. Since add-ins to IE such as ActiveX controls and toolbars run within the IE process, those add-ins run Low as well. The idea behind Protected Mode IE is that even if an attacker somehow defeated every defense mechanism and gained control of the IE process and got it to run some arbitrary code, that code would be severely limited in what it could do. Almost all of the file system and registry would be off-limits to it for writing, reducing the ability of an exploit to modify the system or harm user files. The code wouldn't have enough privileges to install software, put files in the user's Startup folder, hijack browser settings, or other nastiness.