Slashdot Mirror
Researchers 'Break' Microsoft's Edge With Zero-Day Remote Code Exploit (itpro.co.uk)
Exploit developers Yushi Laing and Alexander Kochkov have teased a zero-day exploit for Microsoft's Edge browser that can allow a malicious actor to run commands on a user's machine. "Laing teased the 'stable exploit' for the Microsoft-developed web browser last week with an image that appeared to show the Windows Calculator app launched from a web browser, after working on the project for just under a week," reports IT PRO. From the report: The researcher had initially been looking into three remote code execution bugs for Firefox as part of an 'exploit chain', but struggled to establish code for the third. He then found two similar flaws on Microsoft Edge using the Wadi Fuzzer app developed by SensePost. Laing told BleepingComputer the pair wanted to develop a stable exploit for Microsoft Edge and escape the sandbox, termed as an exploit that force-crashes and incorrectly reloads an app with manipulated permissions.
This would allow a user to run functions, and access other apps, beyond its normal permissions, as well as access data from other applications. They were also looking for a way to effectively seize control of a machine by escalating execution privileges to "system." They published a proof-of-concept for the Edge exploit in a short clip which shows the team using the browser to open the landing page for Google Chrome via Firefox.
This would allow a user to run functions, and access other apps, beyond its normal permissions, as well as access data from other applications. They were also looking for a way to effectively seize control of a machine by escalating execution privileges to "system." They published a proof-of-concept for the Edge exploit in a short clip which shows the team using the browser to open the landing page for Google Chrome via Firefox.
Chakra is open source. What do MS have to lose by githubbing the rest of the browser?
By the "many eyes" theory, security bugs would be dealt with greater expedience if a version of (let's call it) 'Edgium' were available in fedora and debian repositories. And the benefit for Windows 10 is web site compatibility that people might actually test for Edge cases, pun intended, if they could still develop under Linux/macos.
Quite some time ago I came to a conclusion that the safest way to browse the web is to run your web browser in a VM or on a separate device which your log into via network. And, no, running it under a separate user account doesn't cut it because your kernel and local listening daemons are fully exposed to the browser and might be used to circumvent users accounts separation, not to mention various (mostly theoretical but still real) CPU vulnerabilities. Too bad, I haven't followed my own conclusion and I still happily run the browser under my user account without any protections whatsoever, except for uBlock Origin and NoScript.
The reason VM is not particularly well-suited for browsing the web is because 2D/3D acceleration doesn't work well in it, and also there's latency involved which makes the whole experience not exactly perfect - simple web sites work well but anything with heavy JS code and/or various graphical effects might suffer.