ActiveX is by far the largest virus vector, and exists only within IE and the IE rendering engine. The real issue is not opening executables, it's opening the mail at all; embedded ActiveX can execute as well as an executable file can. To be fair to Microsoft, in both the last several versions of Internet Explorer and the last several versions of Outlook, ActiveX content has been clamped down on. But, yes, because of ActiveX, IE has systematic security flaws versus FireFox.