Super Duper Secure Mode
Posted Aug 4, 2021 2021-08-04T08:50:00-07:00 by Johnathan Norman IntroductionThe VR team is experimenting with a new feature that challenges some conventional assumptions held by many in the browser community. Our hope is to build something that changes the modern exploit landscape and significantly raises the cost of exploitation for attackers. Mitigations have a long history of being bypassed, s
UI Security - Thinking Outside the Viewport
Posted Jun 2, 2021 2021-06-02T07:00:00-07:00 by Abdulrahman Alqabandi IntroductionWhen it comes to an application’s user interface (UI), one may care for the aesthetics, design consistency, simplicity, and clarity to ensure a good UI. However, an application like a browser where untrusted content is loaded, parsed, and given APIs to invoke all sorts of UIs then a new layer of concern appears: Desi
Deep Dive into Site Isolation (Part 1)
Posted Nov 10, 2020 2020-11-10T10:00:00-08:00 by Jun Kokatsu Back in 2018, Chrome enabled Site Isolation by default, which mitigates attacks such as UXSS and Spectre. At the time, I was actively participating in the Chrome Vulnerability Reward Program, and I was able to find 10+ bugs in Site Isolation, resulting in $32k rewards. In this blog post series, I will explain how Site Isolation and relat
Safety and privacy in Microsoft Edge
October is almost over! The leaves are changing, pumpkin spices are everywhere, and frights and haunts are becoming commonplace. In the U.S., it’s also National Cyber Security Awareness month. To celebrate it all, we’ll share some of the great security and privacy features that we’ve added to our new browser. Online safety and privacy are important, and we want you to trust that your browser will
Introducing Edge Vulnerability Research
Posted Oct 15, 2020 2020-10-15T15:30:00-07:00 by Johnathan Norman Security is a top priority for Edge and deciding to build a new browser gave us the opportunity to take the lessons learned over many years and rethink our approach to securing the new Microsoft Browser. We knew that securing the browser is about more than just adding new features; it requires a coordinated combination of rapid resp
Announcing Windows 10 Insider Preview Build 17723 and Build 18204
Hello Windows Insiders! Today, we are releasing Windows 10 Insider Preview Build 17723 (RS5) to Windows Insiders in the Fast ring and Build 18204 (19H1) to Windows Insiders who have opted in to Skip Ahead. Going forward, RS5 builds will come from the RS5_RELEASE branch. For Insiders who chose to “skip ahead”, 19H1 builds will continue to come from the RS_PRERELEASE branch. Insiders can see the bra
Previewing support for same-site cookies in Microsoft Edge
Updated 6/27/2018: Same-site cookies are now available for Microsoft Edge and Internet Explorer on the Windows 10 Fall Creators Update and later via the June 2018 Windows Update packages. Users on the Windows Insider Preview will need to use Build 17672 or later to test this feature, as outlined below. Yesterday’s Windows Insider Preview build (build 17672) introduces support for the SameSite cook
Strengthening the Microsoft Edge Sandbox
In a recent post, we outlined the layered strategy that the Microsoft Edge security team employs to protect you from vulnerabilities that could be used to compromise your device or personal data. In particular, we showed how Microsoft Edge is leveraging technologies like Code Integrity Guard (CIG) and Arbitrary Code Guard (ACG) to break some of the techniques that hackers rely on when exploiting v
HTTP Strict Transport Security comes to Internet Explorer 11 on Windows 8.1 and Windows 7
In February, we released the first preview of HTTP Strict Transport Security in Internet Explorer 11 in the Windows 10 Insider Preview. The HTTP Strict Transport Security (HSTS) policy protects against variants of man-in-the-middle attacks that can strip TLS out of communications with a server, leaving the user vulnerable. With today’s monthly security updates (KB 3058515), we’re bringing the prot
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Browser's XSS Filter Bypass Cheat Sheet
Intent to Ship: Long Task API - Google Groups