“CVE-2024-21388”- Microsoft Edge’s Marketing API Exploited for Covert Extension Installation

By Oleg Zaytsev (Guardio Labs)

Guardio Labs discovered a vulnerability in the Microsoft Edge browser, designated CVE-2024–21388. This flaw could have allowed an attacker to exploit a private API, initially intended for marketing purposes, to covertly install additional browser extensions with broad permissions without the user’s knowledge. Promptly after our discovery, we fully disclosed the issue to Microsoft, leading to a resolution in February 2024.In this write-up, we unfold our discovery process, showcase the vulnerability with straightforward Proof …

browser extension browsers cybersecurity exploitation vulnerability