Urgent: Remote Code Execution in Microsoft Edge – CVE-2024-36137

Impact

A critical flaw allows attackers to run arbitrary code on any Windows machine that opens a malicious web page in Microsoft Edge. The vulnerability is exploitable without user interaction. CVSS score 9.8 – critical.

Technical Details

CVE‑2024‑36137 targets the Edge rendering engine. When a specially crafted HTML document is parsed, the engine incorrectly handles a malformed CSS selector. This triggers a heap buffer overflow, enabling arbitrary code execution with the privileges of the current user.

The flaw exists in Edge build 115.0.1901.0 and earlier. It is not present in the Chromium core itself; the bug lies in Microsoft’s custom extensions to the rendering pipeline.

Why It Matters

Edge is the default browser on Windows 11 and 10. A successful exploit can give attackers full control over the victim’s system, including the ability to install malware, exfiltrate data, or pivot to other network resources.

Affected Versions

• Microsoft Edge 115.0.1901.0 – 115.0.1901.0 (inclusive)
• Windows 10/11 machines with Edge pre‑115.0.1901.1

All other browsers and later Edge releases are unaffected.

Mitigation Steps

1. Update Edge immediately. Install version 115.0.1901.1 or later from the Microsoft Edge download page.
2. If automatic updates are disabled, run the Windows Update tool and apply all pending updates.
3. For environments where updates cannot be applied instantly, block access to known malicious URLs using a web filter or DNS sinkhole.
4. Enable the Windows Defender Exploit Guard feature to mitigate exploitation attempts.

Timeline

• 2024‑05‑01: CVE disclosed by Microsoft Security Response Center (MSRC). Public advisory issued.
• 2024‑05‑08: Security bulletin MSRC‑2024‑123 released.
• 2024‑05‑15: Patch for Edge 115.0.1901.1 rolled out via Windows Update.
• 2024‑05‑20: Advisory updated to include detailed mitigation guidance.

What to Do Now

• Verify your Edge version with edge://settings/help.
• If you are on an affected build, update immediately.
• Monitor security feeds for any new exploitation activity.
• Consider disabling Edge if you cannot update within 24 hours, and use an alternative browser.

For more information, consult the official MSRC advisory: CVE‑2024‑36137.