One of the most useful quirks of Microsoft Edge has left users exposed to attacks.

• The comparison
• Tutorials
• One of the most useful quirks of Microsoft Edge has left users exposed to attacks.

Microsoft took steps to address a vulnerability in the translation functionality of the Edge internet browser that left users vulnerable to attack. According to security scholars, the flaw could have allowed attackers to launch remote code execution attacks whenever the translator was called, either automatically or on demand. Since the flaw existed in the internet browser, attackers could essentially exploit it to remotely inject and execute arbitrary code on almost any site, including Facebook, YouTube, and also Instagram.

TheComparison needs you! We're taking a look at how our readers are using VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 5 seconds of your time, and you can also be entered into a draw to win a $XNUMX Amazon voucher or one of XNUMX-year ExpressVPN subscriptions.

Click here to launch the survey in a new window

While Microsoft agrees that exploiting the flaw is not overly complex and that attacks can be done without requiring privileges, the flaw received a fairly low severity rating of fifty-four / ten.

Easy to operate

In a weblog post, the security scholars who discovered the flaw describe it as a universal cross-site scripting (uXSS) vulnerability. Unlike common XSS attacks, uXSS is a type of attack that exploits vulnerabilities on the client-side of the service in the browser (or usually browser extensions) in order to create the conditions to launch an XSS attack. In such a case, the researchers found that Edge's translation feature could be used to bypass most of the browser's security features and also invoke any malicious features. To test the flaw, the researchers ran the exploit on multiple popular sites. In one of the proof-of-term videos, they run their malicious script by simply adding a comment to a Facebook video written in a language other than English. The scholars received a US$XNUMX reward from Microsoft, which fixed the vulnerability.