Loophole in Microsoft Edge allowed unauthorized installation of malicious extensions

digital security company Guardian Laboratories A security vulnerability has been detected in Microsoft Edge for desktop. If misused, it may lead to malicious extensions being installed on your computer.

The flaw may have been built into the Microsoft browser cryptocurrency mining or hijacking tools, data trackers, or even programs that steal access credentialsIncluding usernames and passwords.

The breach, called CVE-2024–21388, was reported to Microsoft in November 2023. Guardian Laboratories discovered the case. In February of the following year, a fix was pushed to the browser in an attempt to prevent this vulnerability from being exploited by criminals.

Space in Microsoft Edge

The installation of fake extensions exploited an error in granting developer privileges. It exploited a limitation in Edge’s own infrastructure, which has been running on Google’s Chromium engine since 2020.

Using a private and proprietary API most commonly used in marketing and installing themes for Edge, Criminals can hide criminal extensions of benign programs. In this way, they become able to: Bypassing the program’s security mechanisms and not even requiring user authorization For installation.

The infection occurred on websites with browser privileges, such as the Bing search engine. In other words, you won’t even need to download an extension from the browser store.

According to the researcher who found the defect, No criminal use of this vulnerability has been recorded until fixed by the company – probably because it involves a high level of prior knowledge and complex actions that need to be found and investigated. Now, if the user updates his browser correctly, the risks will decrease.