Researchers 'Break' Microsoft's Edge With Zero-Day Remote Code Exploit (itpro.co.uk)

Exploit developers Yushi Laing and Alexander Kochkov have teased a zero-day exploit for Microsoft's Edge browser that can allow a malicious actor to run commands on a user's machine. "Laing teased the 'stable exploit' for the Microsoft-developed web browser last week with an image that appeared to show the Windows Calculator app launched from a web browser, after working on the project for just under a week," reports IT PRO. From the report: The researcher had initially been looking into three remote code execution bugs for Firefox as part of an 'exploit chain', but struggled to establish code for the third. He then found two similar flaws on Microsoft Edge using the Wadi Fuzzer app developed by SensePost. Laing told BleepingComputer the pair wanted to develop a stable exploit for Microsoft Edge and escape the sandbox, termed as an exploit that force-crashes and incorrectly reloads an app with manipulated permissions.

This would allow a user to run functions, and access other apps, beyond its normal permissions, as well as access data from other applications. They were also looking for a way to effectively seize control of a machine by escalating execution privileges to "system." They published a proof-of-concept for the Edge exploit in a short clip which shows the team using the browser to open the landing page for Google Chrome via Firefox.

Comments

Re:FOSS

[Gravis Zero]

Chakra is open source. What do MS have to lose by githubbing the rest of the browser?

Exposing just how much information they are gathering about their users would be damaging, especially if the EU uses it to rule against them.

Yeah, they got plenty of money to lose.

Re:FOSS

[Joce640k]

Chakra is open source. What do MS have to lose by githubbing the rest of the browser?

Simple: Somebody might recompile it without all the user-spying and data-gathering code.