3 ms·
Was this properly disclosed? Has it been fixed? I didn't see anything in the article about this but I may have just missed it. But aside from that, this is a
by Klathmon 10y ago
Was this properly disclosed? Has it been fixed?
I didn't see anything in the article about this but I may have just missed it.
But aside from that, this is a pretty big deal. MS Edge has been looking pretty good lately. It felt like they have been taking security more seriously, and the new AppGuard stuff looked interesting, but even that doesn't look like it would fix this as it looks like this is "working as intended" letting any link communicate outside the "web sandbox".
I was hoping Edge wouldn't go down the same path that IE did with "special" tie ins to the OS, but it seems they are still trying.
- spikengineer 10y agoThe last line of the article links to the email the poster sent to microsoft security report email.
- mimimimi2 10y agoI don't really think they even check their email.
- vesinisa 10y ago> I was hoping Edge wouldn't go down the same path that IE did with "special" tie ins to the OS Any app on Android, iOS or Windows can register themselves as a handler for an URI scheme. There is nothing "special" about that. It's up to the app author to ensure this does not expose an attack surface.
- Klathmon 10y agoNot saying it's special, but at least on chrome it will ask if you want to open that link in another application. Here it seems at least built-in MS applications are exempt from that.
- matt_kantor 10y agoI believe that prompt is a Chrome feature, not an OS feature.
- mtgx 10y agoOf course it did. The first clue to that was that it was Windows 10-only. Edge is hardly a reason to "move to Windows 10", so I guess Microsoft just doesn't care about browser market share that much anymore.
- deleted 10y ago[deleted]
- pixelcloud 10y agoAt the very bottom is did say "Reported to MSRC" with a copy of the email.