Nov 24, 2021
0 0

Microsoft Edge adds Super Duper Secure Mode to Stable channel

Written by

Apple sues spyware-maker NSO Group, notifies iOS exploit targets
Over nine million Android devices infected by info-stealing trojan
Exploit released for Microsoft Exchange RCE bug, patch now
Malware now trying to exploit new Windows Installer zero-day
Threat actors find and compromise exposed services in 24 hours
Malware now trying to exploit new Windows Installer zero-day
The Best Black Friday 2021 Security, IT, VPN, & Antivirus Deals
FBI warns of phishing targeting high-profile brands’ customers
Qualys BrowserCheck
Junkware Removal Tool
How to remove the PBlock+ adware browser extension
Remove the Search Redirect
Remove the Search Redirect
Remove the Search Redirect
Remove Security Tool and SecurityTool (Uninstall Guide)
How to remove Antivirus 2009 (Uninstall Instructions)
How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller
Locky Ransomware Information, Help Guide, and FAQ
CryptoLocker Ransomware Information Guide and FAQ
CryptorBit and HowDecrypt Information Guide and FAQ
CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
How to make the Start menu full screen in Windows 10
How to install the Microsoft Visual C++ 2015 Runtime
How to open an elevated PowerShell Admin prompt in Windows 10
How to Translate a Web Page in Google Chrome
How to start Windows in Safe Mode
How to remove a Trojan, Virus, Worm, or other Malware
How to show hidden files in Windows 7
How to see hidden files in Windows
IT Certification Courses
Gear + Gadgets
Microsoft Edge adds Super Duper Secure Mode to Stable channel
Microsoft has quietly added a ‘Super Duper Secure Mode’ to the Microsoft Edge web browser, a new feature that brings security improvements without significant performance losses.
Users can enable Super Duper Secure Mode after upgrading Edge to stable version 96.0.1054.29 or later, and they can toggle between Balanced and Strict modes for different levels of security increase.
The new feature, under testing by the Edge Vulnerability Research team since August, removes Just-In-Time Compilation (JIT) from the V8 processing pipeline, thus reducing the attack surface threat actors can exploit to hack into Edge users’ systems. 
Microsoft describes Super Duper Secure Mode as “a browsing mode in Microsoft Edge where the security of your browser takes priority, providing you an extra layer of protection when browsing the web.”
“We quietly released Super Duper Secure Mode to stable (96.0.1054.29),” said Johnathan Norman, Microsoft Edge Vulnerability Research Lead.
“Balanced learns what sites you use often and trusts those, strict is well.. strict 🙂 Users can now add their own exceptions.”
When toggled on, Super Duper Secure Mode disables JIT (TurboFan/Sparkplug) and enables Intel’s Control-flow Enforcement Technology (CET), a hardware-based exploit mitigation that provides a more secure browsing experience.
As Norman revealed in August when the feature was first announced, roughly 45% of all security vulnerabilities found in the V8 JavaScript and WebAssembly engine were related to the JIT engine, accounting for over half of all ‘in the wild’ Chrome exploits abusing JIT bugs.
By disabling JIT, the attack surface is drastically reduced by removing almost half of the V8 bugs that should be fixed.
“This reduction in attack surface kills half of the bugs we see in exploits and every remaining bug becomes more difficult to exploit. To put it another way, we lower costs for users but increase costs for attackers,” Norman explained.
In the future, Microsoft aims to include support for Arbitrary Code Guard (ACG) in Super Duper Secure Mode, another security mitigation that would block attackers from loading malicious code into memory, a known technique used by most web browser exploits.
The Edge Vulnerability Research team also plans to ship the new feature with the Android and macOS Edge versions.
At the moment we are disabling JIT and enabling CET in the renderer process. ACG enablement is next after we do some testing. We also have plans for Android and Mac as well. Android being the most interesting since mobile is such a key target 6/?
Microsoft Edge for Linux out of beta, now generally available
Brave ditches Google for its own privacy-centric search engine
Malicious Chrome ad blocker injects ads behind the scenes
Brave web browser will add bounce tracking privacy protection
Not a member yet? Register Now
New Windows zero-day with public exploit lets you become an admin
Over nine million Android devices infected by info-stealing trojan
To receive periodic updates and news from BleepingComputer, please use the form below.
Terms of Use Privacy PolicyEthics Statement
Copyright @ 2003 – 2021 Bleeping Computer® LLC – All Rights Reserved
Not a member yet? Register Now
Read our posting guidelinese to learn what content is prohibited.


Article Categories:
Cybersecurity News

Comments are closed.