Cutting Edge: Microsoft Browser Security — From People Who Owned It

on YouTube ↗44m

" summary

Deep dive into Edge internals reveals concrete exploit chains: researchers extract how UWP lowbox tokens are derived from package seeds, enumerate IPC (RPC, COM, LCIE shared memory), and abuse a browser broker DLL hijack (activating a new broker via CLSID then loading a custom DLL from the app directory) plus a Flash add-in chain (signed .zip/.s files from markulamediacom run by flash broker) to escalate from Internet renderer to local renderer to broker and achieve sandbox escape; Microsoft patches restrict broker launches and add integrity/token attribute checks.

AI-written summary · about

" chapters (31)

1. 0:00Intro
2. 2:10Universal Windows Platform
3. 4:08Microsoft Edge Architecture
4. 5:23Manager Process Startup
5. 7:17Activation Information
6. 8:27Manager Process Capabilities
7. 9:01Content Process Startup
8. 10:00black hat Child Process Token and Capabilities
9. 11:12Child Process Capability SIDs
10. 13:24JIT Engine RPC
11. 14:50Out-of-Process COM Activation
12. 15:43COM Security
13. 18:12LCIE IPC Message Security
14. 20:22black hat Launch Browser Broker in Manager
15. 21:31Unmarshal Interface
16. 21:50Browser Broker Structure
17. 22:18Edge Process Integrity
18. 22:54Access Check
19. 23:26Trusted AC
20. 24:45black hat ALL APPLICATION PACKAGES
21. 28:34Microsoft Edge Adobe Flash Integration
22. 29:28Flash Broker Permissions
23. 30:03Flash Broker Activation
24. 30:33Flash Broker Features
25. 31:15Launch Adobe Connect Add-in
26. 33:40A Bug in Macromedia Breeze
27. 34:29From Attackers' Perspective
28. 35:22Navigate from Internet Zone to Local Zone
29. 35:43Behind a Navigation
30. 38:03Exploit the SOP Bypass
31. 41:05Recap

" related talks

• 31mPiloting Edge CopilotJun Kokatsu · CODE BLUE 2024
• 33mOver the Edge: Silently Owning Windows 10's Secure BrowserHerbert Bos, Erik Bosman, Kaveh Razavi, Cristiano Giuffrida · Black Hat USA 2016
• 57mDigging for IE11 Sandbox Escapes Part 1James Forshaw · Black Hat USA 2014
• 40mDigging for IE11 Sandbox Escapes Part 2James Forshaw · Black Hat USA 2014
• 49m$Hell on Earth: From Browser to System CompromiseJoshua Smith, Abdul Aziz Hariri, Matt Molinyawe, Jasiel Spelman · Black Hat USA 2016
• 41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon WaysBrian Gorenc, Jasiel Spelman · Black Hat USA 2014
• 51mWindows 10 Mitigation ImprovementsDavid Weston, Matt Miller · Black Hat USA 2016
• 43mHunting for Bugs, Catching DragonsNicolas Joly · Black Hat USA 2019