CVE-2023-36787
📋 TL;DR
This vulnerability in Microsoft Edge (Chromium-based) allows attackers to gain elevated privileges through a use-after-free memory corruption flaw. It affects users running vulnerable versions of Microsoft Edge on Windows systems. Successful exploitation could allow attackers to execute arbitrary code with higher privileges than intended.
💻 Affected Systems
- Microsoft Edge (Chromium-based)
📦 What is this software?
Edge Chromium by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM-level privileges, allowing installation of persistent malware, data theft, and lateral movement across the network.
Likely Case
Local privilege escalation enabling attackers to bypass security controls, install additional malware, or access restricted system resources.
If Mitigated
Limited impact with proper patch management and security controls; exploitation attempts would be blocked or detected.
🎯 Exploit Status
Exploitation requires local access and specific conditions; no public exploits known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 116.0.1938.69 and later
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36787
Restart Required: Yes
Instructions:
1. Open Microsoft Edge 2. Click Settings (three dots) → Help and feedback → About Microsoft Edge 3. Browser will automatically check for and install updates 4. Restart Edge when prompted
🔧 Temporary Workarounds
Disable Edge via Group Policy
windowsTemporarily disable Microsoft Edge while awaiting patch deployment
gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Microsoft Edge → 'Allow Microsoft Edge to start and load the Start and New Tab page at Windows startup, and each time Microsoft Edge is closed' → Disabled
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized Edge execution
- Enable Windows Defender Exploit Guard with Attack Surface Reduction rules
🔍 How to Verify
Check if Vulnerable:
Check Edge version: edge://settings/help or edge://versionCheck Version:
msedge --versionVerify Fix Applied:
Verify Edge version is 116.0.1938.69 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual Edge process creation with elevated privileges
- Edge crash reports with memory corruption signatures
Network Indicators:
- Unusual outbound connections from Edge processes
SIEM Query:
Process Creation where (Image contains 'msedge.exe' and IntegrityLevel contains 'High' or 'System')