/>
X

Microsoft: This new browser feature is 'huge step forward' against zero-day threats

Microsoft brings out its Windows exploit mitigation technologies to protect surfers from zero-day exploits on the web.
liam-tung.jpg
Written by Liam Tung, Contributor on

Microsoft has shown off a new measure for admins to protect web-browsing users on Chromium-based Edge from zero days, which are previously unknown software flaws. 

The latest Edge beta introduces a new browsing mode in Edge "where the security of your browser takes priority". For admins who fear web-based attacks on desktop systems via the browser, this feature gives them the option to "mitigate unforeseen active zero days". Enabling this mode can be configured, so that important sites and line-of-business applications "continue to work as expected," according to Microsoft's release notes

The security-focused Edge mode, spotted by Bleeping Computer, brings several Windows exploit mitigation technologies into play, including Hardware-enforced Stack Protection, Arbitrary Code Guard (ACG), and Control Flow Guard (CFG)

SEE: Your cybersecurity training needs improvement because hacking attacks are only getting worse

Windows 10's ACG helps thwart web attacks that attempt to load malicious code into memory by ensuring only properly signed code can be mapped into memory.

ACG and CFG were key motivations behind Microsoft's move last year to introduce Edge Super Duper Secure Mode, which turns off Edge's Chromium JavaScript just-in-time (JIT) compiler to allow those exploit mitigations, as well as Intel's Control-flow Enforcement Technology (CET), to work. The JIT compiler is part of the Chromium V8 JavaScript engine's processing pipeline, but Windows features like ACG were incompatible with JIT compiling. 

"This feature is a huge step forward because it lets us mitigate unforeseen active zero days (based on historical trends). When turned on, this feature brings Hardware-enforced Stack Protection, Arbitrary Code Guard (ACG), and Content Flow Guard (CFG) as supporting security mitigations to increase users' security on the web," Microsoft explains. 

Microsoft quietly enabled Edge Super Duper Secure Mode in the stable release of Edge in November, allowing users to toggle between 'balanced' and 'strict' modes, depending on how much users trust a given site.   

The browser update, version 98.0.1108.23 in the Microsoft Edge beta channel, also adds a custom primary password option. This option adds another layer of privacy and helps prevent unauthorized users from using saved passwords to log on to websites. Custom primary password allows users to use a custom string of their choice as their primary password. After it's enabled, users will enter this password to authenticate themselves and have their saved passwords auto-filled into web forms.

Related

Southwest Airlines has cancelled 20,000 flights. Now for the really bad news
screen-shot-2021-07-07-at-4-01-12-pm.png

Southwest Airlines has cancelled 20,000 flights. Now for the really bad news

Business
How to stop spam messages on your iPhone with this almost-secret hidden switch
messages.jpg

How to stop spam messages on your iPhone with this almost-secret hidden switch

Security
How to clean any flat screen TV or monitor
sample-image-16-9-red.jpg

How to clean any flat screen TV or monitor

TVs