Microsoft Fixes Critical Same-Origin Policy Security Exploit for Edge

• A vulnerability in Microsoft Edge was found by security researcher Ziyahan Albeniz from Netsparker that allowed attackers to inject malware into target PCs. 
• The vulnerability was found in the Same-Origin Policy security feature which is present in all major browsers.
• The exploit involved tricking users into downloading a malicious HTML file and running it, which would allow local file access to attackers.

A critical security flaw that was found in Microsoft Edge has been patched by the tech giant. First spotted by Netsparker security researcher Ziyahan Albeniz, the exploit was ironically found in a security feature designed to prevent attackers from loading malicious code via web links. The Same-Origin Policy (SOP) is found in all standard browsers, and a vulnerability in Microsoft’s implementation of the feature on Edge allowed attackers access to private files located on hard drives.

Albeniz revealed in a report "The only way to protect yourself is to update to the latest versions of the Edge browser and Windows Mail and Calendar applications. And, of course, it's best to never open attachments from unknown senders, even if the extension doesn't initially appear to be malicious”.

https://www.youtube.com/watch?v=l8HPDWFejVo

Fortunately, the exploit required social engineering which prevents large-scale attacks from being automated by hackers. To successfully implement an SOP attack, hackers would need to trick users into downloading an HTML file with malicious code embedded via the Edge browser. Opening the file via Edge, Mail or Microsoft Calendar would allow attackers access to private storage devices and their local files.

The exploit loads via the “file://” protocol and steals all files that are located via the URL. Attackers could simply transfer all of the files on a PC and send them to a remote server. With HTML files not being associated with malware campaigns most of the time, users are unaware of the threat they can possess.

If you use Microsoft Edge, you should update to the latest version right away. Additionally, to safeguard yourself from malware, it is recommended to scan all files you download or receive via email before opening them with reliable antivirus software.

Have you ever been affected by malware attacks while using Microsoft Edge? Let us know in the comments below. And also, don’t miss out on your chance to follow us on Facebook and Twitter. Thanks!