https://microsoftedge.github.io/edgevr/Microsoft Browser Vulnerability ResearchPublic blog for the Edge Vulnerability Research team. 2026-09-23T11:46:15-07:00 Microsoft Corporation https://microsoftedge.github.io/edgevr/ Jekyll © 2026 Microsoft Corporation /edgevr/assets/img/favicons/favicon.ico /edgevr/assets/img/favicons/favicon-96x96.png Beyond Images: Bringing Rust Brotli to Edge Network Stack2026-09-23T07:00:00-07:00 2026-09-23T07:00:00-07:00 https://microsoftedge.github.io/edgevr/posts/Beyond-Images-Bringing-Rust-Brotli-to-Edge-Network-Stack/ marco Introduction In our previous post we described how the Edge Security team turned the Rust PNG proof point into a repeatable rustification model and applied it to attacker-facing image formats such as BMP and ICO. We chose image codecs as our first target because they have clean dependency boundaries and are a potential attack vector, since they directly process attacker-controlled input. Codec... Rustifying Image Codecs in Chromium2026-07-17T07:00:00-07:00 2026-07-17T07:00:00-07:00 https://microsoftedge.github.io/edgevr/posts/Rustifying-Image-Codecs-in-Chromium/ sergio A cross-team effort to make browser image decoding safer without slowing the web down. Introduction Image decoding is on the hot path in every modern browser. Page loads, <img> tags, and favicons all require parsing bytes straight from the untrusted web. Media codecs have been a steady source of security bugs, especially in large, highly optimized C++ codebases where memory safety is di... Inside StegoAd: How We Disrupted a Massive Malicious Extension Campaign2026-06-16T07:00:00-07:00 2026-06-16T07:00:00-07:00 https://microsoftedge.github.io/edgevr/posts/Inside-StegoAd-How-We-Disrupted-a-Massive-Malicious-Extension-Campaign/ edgeextensionsteam 119 extensions, up to 2.6 million installs, delayed execution, and payloads hidden inside image and font files. Here’s what we found, how we disrupted it, and how we’re protecting you. Browser extensions make every day browsing better — blocking ads, translating pages, and downloading videos. Millions of people trust them. But what happens when that trust is exploited? Through proactive threa... Saved passwords in Edge memory: what we're changing and why2026-05-14T07:00:00-07:00 2026-05-14T07:00:00-07:00 https://microsoftedge.github.io/edgevr/posts/Saved-passwords-in-Edge-memory-what-were-changing-and-why/ kryc Browsers help protect some of the most sensitive data people have, including passwords. That’s why we continuously review how Edge handles that data, and where we can further reduce exposure through defense-in-depth improvements as part of Microsoft’s Secure Future Initiative (SFI). Last week, security researcher Tom Jøran Sønstebyseter Rønning publicly disclosed that Edge loads saved password... Using Markov Models for Password Complexity Estimation in Microsoft Edge2026-03-23T23:30:00-07:00 2026-03-23T23:30:00-07:00 https://microsoftedge.github.io/edgevr/posts/Using-Markov-model-for-password-complexity-estimation-in-microsoft-edge/ kryc Despite recent advancements in adoption of passkeys, passwords remain one of the most widely used authentication mechanisms on the web, yet repeated studies have demonstrated that humans are particularly bad at generating them. Chromium (the open-source project that Edge and Chrome are based upon) uses a library called “zxcvbn” created by Dropbox to perform strength estimation, and you may have...