Browser extension stores review submissions to identify harmful or deceptive behavior before they reach users. Microsoft Edge Extension Security investigated a family of store-hosted extensions tha...
Microsoft Edge Security, along with Microsoft Threat Intelligence and MSRC, recently disrupted several sustained attack campaigns against Chromium-based browsers. This activity reveals a disturbing...
Introduction In our previous post we described how the Edge Security team turned the Rust PNG proof point into a repeatable rustification model and applied it to attacker-facing image formats such...
A cross-team effort to make browser image decoding safer without slowing the web down. Introduction Image decoding is on the hot path in every modern browser. Page loads, <img> tags, and fa...
119 extensions, up to 2.6 million installs, delayed execution, and payloads hidden inside image and font files. Here’s what we found, how we disrupted it, and how we’re protecting you. Browser ext...
Browsers help protect some of the most sensitive data people have, including passwords. That’s why we continuously review how Edge handles that data, and where we can further reduce exposure throug...
Despite recent advancements in adoption of passkeys, passwords remain one of the most widely used authentication mechanisms on the web, yet repeated studies have demonstrated that humans are partic...
Introduction The digital threat landscape is in a constant state of flux, with attackers perpetually seeking new avenues to compromise users and corporate environments. As a result, the Edge brows...
In a previous blog Browser Security Bugs that Aren’t we covered some of the most common submissions to Microsoft Edge’s Bug Bounty program but which unfortunately do not qualify for a reward. The p...
What is RIDL and Why Should you Care? In 2019 researchers from Vrije Universiteit Amsterdam shared details of a new side-channel attack which they coined “Rogue In-Flight Data Load” (RIDL). It was...