First externally discovered flaws in Microsoft Edge (Chromium) uncovered

guest · Dec 31, 2019

First externally discovered flaws in Microsoft Edge (Chromium) uncovered
Researcher earns $40k
December 31, 2019
https://portswigger.net/daily-swig/...ed-flaws-in-microsoft-edge-chromium-uncovered

Abdulrhman Alqabandi discovered three distinct bugs in the new browser that collectively earns him $40,000 under a reward program set up by Microsoft back in August.

Although unconfirmed, Alqabandi suspects a separate bug he discovered might have allowed for the creation of a remote code execution (RCE) exploit, rather than the simple browser crash he was able to produce.
One of the XSS bugs involved a new feature in a component of the New Tab Page (NTP) of the revamped Edge browser and related to a failure to sanitize the title of visited web pages. The shortcoming meant that potentially hostile JavaScript was executed.

The last of the three bugs found by Alqabandi involved cookie manipulation, abusing a legacy MSN site, and taking over the NTP page, as Alqabandi explains in a detailed technical blog post. The post features PoC code and videos.
Click to expand...

In response to queries from The Daily Swig, Alqabandi commented on the seriousness of the various vulnerabilities he found in Edge:

“Worst case the bugs (first two) can lead to remote code execution by having a user simply visit a web page.
Alqabandi reported his findings to Microsoft in September before publicly disclosing his research over the festive season, after Microsoft had dealt with his report.
Click to expand...

Microsoft Edge (Chromium) - EoP via XSS to Potential RCE

Log in or Sign up

First externally discovered flaws in Microsoft Edge (Chromium) uncovered

guest Guest

Log in or Sign up

First externally discovered flaws in Microsoft Edge (Chromium) uncovered

guest Guest

Useful Searches