diff --git a/dlls/mshtml/htmldoc.c b/dlls/mshtml/htmldoc.c
index bfde79d53c6..d6baa8eb814 100644
--- a/dlls/mshtml/htmldoc.c
+++ b/dlls/mshtml/htmldoc.c
@@ -1772,6 +1772,9 @@ void HTMLDocumentNode_destructor(HTMLDOMNode *iface)
 {
     HTMLDocumentNode *This = HTMLDOCNODE_NODE_THIS(iface);
 
+    if(This->secmgr)
+        IInternetSecurityManager_Release(This->secmgr);
+
     detach_selection(This);
     detach_ranges(This);
     release_nodes(This);
@@ -1805,6 +1808,7 @@ static dispex_static_data_t HTMLDocumentNode_dispex = {
 HRESULT create_doc_from_nsdoc(nsIDOMHTMLDocument *nsdoc, HTMLDocumentObj *doc_obj, HTMLWindow *window, HTMLDocumentNode **ret)
 {
     HTMLDocumentNode *doc;
+    HRESULT hres;
 
     doc = heap_alloc_zero(sizeof(HTMLDocumentNode));
     if(!doc)
@@ -1829,6 +1833,12 @@ HRESULT create_doc_from_nsdoc(nsIDOMHTMLDocument *nsdoc, HTMLDocumentObj *doc_ob
     HTMLDOMNode_Init(doc, &doc->node, (nsIDOMNode*)nsdoc);
     doc->node.vtbl = &HTMLDocumentNodeImplVtbl;
 
+    hres = CoInternetCreateSecurityManager(NULL, &doc->secmgr, 0);
+    if(FAILED(hres)) {
+        htmldoc_release(&doc->basedoc);
+        return hres;
+    }
+
     *ret = doc;
     return S_OK;
 }
diff --git a/dlls/mshtml/mshtml_private.h b/dlls/mshtml/mshtml_private.h
index 17fa9715fbd..82e1c60a64d 100644
--- a/dlls/mshtml/mshtml_private.h
+++ b/dlls/mshtml/mshtml_private.h
@@ -471,6 +471,8 @@ struct HTMLDocumentNode {
 
     HTMLDOMNode *nodes;
 
+    IInternetSecurityManager *secmgr;
+
     struct list selection_list;
     struct list range_list;
 };
diff --git a/dlls/mshtml/secmgr.c b/dlls/mshtml/secmgr.c
index 617cb230670..c9b1e4625e3 100644
--- a/dlls/mshtml/secmgr.c
+++ b/dlls/mshtml/secmgr.c
@@ -34,6 +34,8 @@
 
 WINE_DEFAULT_DEBUG_CHANNEL(mshtml);
 
+static const WCHAR about_blankW[] = {'a','b','o','u','t',':','b','l','a','n','k',0};
+
 #define HOSTSECMGR_THIS(iface) DEFINE_THIS(HTMLDocumentNode, IInternetHostSecurityManager, iface)
 
 static HRESULT WINAPI InternetHostSecurityManager_QueryInterface(IInternetHostSecurityManager *iface, REFIID riid, void **ppv)
@@ -66,8 +68,14 @@ static HRESULT WINAPI InternetHostSecurityManager_ProcessUrlAction(IInternetHost
         BYTE *pPolicy, DWORD cbPolicy, BYTE *pContext, DWORD cbContext, DWORD dwFlags, DWORD dwReserved)
 {
     HTMLDocumentNode *This = HOSTSECMGR_THIS(iface);
-    FIXME("%p)->(%d %p %d %p %d %x %x)\n", This, dwAction, pPolicy, cbPolicy, pContext, cbContext, dwFlags, dwReserved);
-    return E_NOTIMPL;
+    const WCHAR *url;
+
+    TRACE("%p)->(%d %p %d %p %d %x %x)\n", This, dwAction, pPolicy, cbPolicy, pContext, cbContext, dwFlags, dwReserved);
+
+    url = This->basedoc.doc_obj->url ? This->basedoc.doc_obj->url : about_blankW;
+
+    return IInternetSecurityManager_ProcessUrlAction(This->secmgr, url, dwAction, pPolicy, cbPolicy,
+            pContext, cbContext, dwFlags, dwReserved);
 }
 
 static HRESULT WINAPI InternetHostSecurityManager_QueryCustomPolicy(IInternetHostSecurityManager *iface, REFGUID guidKey,
diff --git a/dlls/mshtml/tests/script.c b/dlls/mshtml/tests/script.c
index 92897a60dd7..89b076c727e 100644
--- a/dlls/mshtml/tests/script.c
+++ b/dlls/mshtml/tests/script.c
@@ -117,6 +117,8 @@ DEFINE_EXPECT(script_testprop_i);
 
 static const GUID CLSID_TestScript =
     {0x178fc163,0xf585,0x4e24,{0x9c,0x13,0x4b,0xb7,0xfa,0xf8,0x07,0x46}};
+static const GUID CLSID_TestActiveX =
+    {0x178fc163,0xf585,0x4e24,{0x9c,0x13,0x4b,0xb7,0xfa,0xf8,0x06,0x46}};
 
 static IHTMLDocument2 *notif_doc;
 static IDispatchEx *window_dispex;
@@ -575,6 +577,7 @@ static void test_security(void)
 {
     IInternetHostSecurityManager *sec_mgr;
     IServiceProvider *sp;
+    DWORD policy;
     HRESULT hres;
 
     hres = IActiveScriptSite_QueryInterface(site, &IID_IServiceProvider, (void**)&sp);
@@ -585,6 +588,11 @@ static void test_security(void)
     IServiceProvider_Release(sp);
     ok(hres == S_OK, "QueryService failed: %08x\n", hres);
 
+    hres = IInternetHostSecurityManager_ProcessUrlAction(sec_mgr, URLACTION_ACTIVEX_RUN, (BYTE*)&policy, sizeof(policy),
+                                                         (BYTE*)&CLSID_TestActiveX, sizeof(CLSID), 0, 0);
+    ok(hres == S_OK, "ProcessUrlAction failed: %08x\n", hres);
+    ok(policy == URLPOLICY_ALLOW, "policy = %x\n", policy);
+
     IInternetHostSecurityManager_Release(sec_mgr);
 }