It's so Microsoft. Microsoft has a long history of executing anything that looks executable, going back to "autorun" on CD-ROMs. This continued through a long history of Excel and Word executable behaviors, most of which led to exploits. For a few years, Microsoft cleaned up their act. But in the new cloud-centric world of Windows 10 and the Edge browser, it seems that Microsoft has returned to their old strategy of invoking Microsoft products on external data whenever possible.

The "ms-windows-store:" protocol is documented.[1] Some other fun things you can launch:

- ms-people: - Opens the contacts list program.

- ms-settings: - Opens the settings program. Microsoft encourages using this so that if your app wants, say, to access the microphone, and privacy settings won't permit it, it can force the privacy settings app open to apply pressure to the user to let the app use the microphone.

- ms-windows-store: - aim user at the Windows store for a specific item

- bingmaps:, ms-drive-to:, and ms-walk-to: - bring up the native map application

- ms-tonepicker: - mess with ringtone settings

There's no mention of "read:", though.

However, any installed app can install new protocol IDs, and web pages can then trigger that app. What could possibly go wrong?

[1] https://msdn.microsoft.com/en-us/windows/uwp/launch-resume/l...