CERT-In finds multiple bugs in Microsoft Edge, advises users to update

NEW DELHI: The Indian Computer Emergency Response Team (CERT-In), which comes under the Ministry of Electronics & Information Technology, on Wednesday warned users of multiple vulnerabilities in Microsoft Edge which could allow an attacker to obtain sensitive information, bypass security restriction and cause denial-of-service (DoS) conditions on the targeted system.

The affected software includes Microsoft Edge (Stable) versions before '124.0.2478.51'.

"Multiple vulnerabilities have been reported in Microsoft Edge (chromium-based) which could allow the remote attacker to cause a denial of service condition, remote code execution, sensitive information disclosure and security restriction bypass on the targeted system," said the CERT-In advisory.

According to the cyber agency, these vulnerabilities exist in Microsoft Edge due to object corruption in V8 and WebAssembly, use after free in V8, downloads and QUIC, inappropriate implementation in autofill, inappropriate implementation in extension, network and prompts, and others.

"A remote attacker could exploit these vulnerabilities by sending a specially crafted request on the targeted system," the agency mentioned.

Cert-In advised users to apply appropriate security updates as mentioned by the company. Earlier this month, the cyber agency warned users of multiple vulnerabilities in Microsoft products which include -- Microsoft Windows, Microsoft Office, Developer Tools, Azure, Brower, System Center, Microsoft Dynamics, and Exchange Server. As per the advisory, these vulnerabilities could allow an attacker to obtain information disclosure, bypass security restrictions and cause DoS conditions on the targeted system.