![\"\"](\"https:\/\/sitesdev.net\/articles\/wp-content\/uploads\/2017\/05\/NewXMicrosoft.jpg\")
Manuel Caballero has been a busy man.<\/p>\nManuel Caballero has been a busy man.<\/p>\n
If you haven\u2019t heard of him, he\u2019s a security researcher and blogger who made a name for himself identifying a variety of critical security flaws in the old Internet Explorer web browser. It would probably be overstating to say that he was instrumental in Internet Explorer\u2019s eventual death, and Microsoft\u2019s decision to try again with its new \u201cEdge\u201d browser, but he was certainly part of the chorus of voices expressing concerns over the old browser\u2019s security. Now, he\u2019s finding flaws in Microsoft Edge.<\/p>\n
To their credit, Microsoft took the lessons they learned during the Internet Explorer days to heart and made a real effort to make Edge more robust and secure. An important part of that was the introduction of SOP, the Same Origin Policy, which is a security feature that prevents one website from loading and executing scripts that originated from a different site.<\/p>\n
It’s a good feature, as long as it works, and therein lies the problem. Cabellero recently discovered a vulnerability that allows hackers to completely circumvent SOP. This means that they can use domainless web pages, meta refresh tags and URI\u2019s to launch malicious code with an eye toward gaining varying degrees of control over your computer.
\nHe released three proof-of-concept demos of the various ways attacks could be launched and made a video demo outlining how and why they work.<\/p>\n
Of particular interest is the fact that attacks like these can be automated via malvertising, or malicious advertising that delivers poisoned JavaScript code to browsers. Using an ad-based platform like this, a hacker can infect thousands of individual users at a time.<\/p>\n
Microsoft has been made aware of the issue, but at this time, it remains unpatched, and the company has not given an ETA on when they\u2019ll have a fix ready. Bear that in mind if you use Microsoft Edge at home or in your office.<\/p>\n","protected":false},"excerpt":{"rendered":"
Manuel Caballero has been a busy man. If you haven\u2019t heard of him, he\u2019s a security researcher and blogger who made a name for himself identifying a variety of critical security flaws in the old Internet Explorer web browser. It would probably be overstating to say that he was instrumental in Internet Explorer\u2019s eventual death, […]<\/p>\n","protected":false},"author":5,"featured_media":25320,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[34,30],"yoast_head":"\n