Significant security issue with polyfill.io

[Davide Cervone]

Folks:

In the past, MathJax has recommended including a <script> tag that refers to polyfill.io in order to include support for IE11 and other older browsers.  You should remove these script files from your websites.  The polydill.io site has been purchased by a Chinese company that has used it to inject malware into sites that use it, as described in this article:

https://sansec.io/research/polyfill-supply-chain-attack

There is really no need to include this polyfill any longer, as all modern browsers can run MathJax without it.

Please be sure to update your websites to remove this significant security issue!

Davide P. Cervone

MathJax lead developer