CVE-2023-36887
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on systems running vulnerable versions of Microsoft Edge. Attackers can exploit this by tricking users into visiting a malicious website or opening a specially crafted file. All users of affected Microsoft Edge versions are at risk.
💻 Affected Systems
- Microsoft Edge (Chromium-based)
📦 What is this software?
Edge Chromium by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the victim's computer, enabling data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Malicious code execution in the context of the current user, potentially leading to credential theft, data exfiltration, or lateral movement within the network.
If Mitigated
Limited impact with proper security controls like application sandboxing, exploit mitigations, and network segmentation preventing full system compromise.
🎯 Exploit Status
Exploitation requires user interaction (visiting malicious website or opening malicious file). No authentication required for initial access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Microsoft Edge version 116.0.1938.54 or later
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36887
Restart Required: Yes
Instructions:
1. Open Microsoft Edge. 2. Click Settings (three dots) → Help and feedback → About Microsoft Edge. 3. Browser will automatically check for updates and install if available. 4. Restart Edge when prompted.
🔧 Temporary Workarounds
Disable JavaScript Execution
windowsTemporarily disable JavaScript in Microsoft Edge to prevent exploitation through malicious websites
edge://settings/content/javascript
Use Application Control
windowsImplement application whitelisting to prevent unauthorized code execution
🧯 If You Can't Patch
- Restrict user access to untrusted websites using web filtering solutions
- Implement network segmentation to limit lateral movement if exploitation occurs
🔍 How to Verify
Check if Vulnerable:
Check Microsoft Edge version by navigating to edge://settings/help. If version is below 116.0.1938.54, system is vulnerable.Check Version:
edge://settings/helpVerify Fix Applied:
After updating, verify version is 116.0.1938.54 or higher in edge://settings/help.📡 Detection & Monitoring
Log Indicators:
- Unusual Edge process behavior
- Suspicious child processes spawned from Edge
- Unexpected network connections from Edge
Network Indicators:
- Outbound connections to known malicious domains from Edge
- Unusual download patterns from Edge
SIEM Query:
Process Creation where ParentImage contains "msedge.exe" and CommandLine contains suspicious patterns