Security Feature Bypass in Microsoft Edge Through Improper Extension Handling
CVE-2019-1413

4.3MEDIUM

Key Information:

Vendor
Microsoft
Status
Microsoft Edge (edgehtml-based) On Windows Server 2016
Microsoft Edge (edgehtml-based) On Windows 10 Version 1607 For 32-bit Systems
Microsoft Edge (edgehtml-based) On Windows 10 Version 1607 For X64-based Systems
Microsoft Edge (edgehtml-based) On Windows 10 Version 1709 For 32-bit Systems
Vendor
CVE Published:
12 November 2019

Summary

A security feature bypass vulnerability has been identified in Microsoft Edge due to improper handling of extension requests. This flaw allows the browser to fail to request host permissions for all URLs when extensions are triggered, potentially exposing users to unauthorized access or manipulation of web resources. Proper mitigation is necessary to ensure that web extensions operate within the intended security parameters, safeguarding user data and privacy.

Affected Version(s)

Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for 32-bit Systems = unspecified

Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for x64-based Systems = unspecified

Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1709 for 32-bit Systems = unspecified

References

https://portal.msrc.microsoft.com/en-US/security-guidance...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.