---

Introduction

In May 2022, Microsoft disclosed a security flaw tracked as CVE-2022-29144 in its Chromium-based Edge browser. This vulnerability allows a local attacker to gain elevation of privilege — essentially, do things on a computer that only higher-privileged users should be allowed to do. If you use Microsoft Edge or manage corporate desktops, read on to learn what’s behind this CVE, see sample code, and understand how it can be exploited.

What is CVE-2022-29144?

This security issue affects the Chromium core in Edge and comes from improper validation of certain process privileges. When Edge spins up new processes—like rendering web pages—it has to make sure these processes don’t gain more permissions than intended. CVE-2022-29144 is about a bug where a crafted script or software could abuse how Edge creates these processes and end up running with higher OS privileges.

Microsoft Advisory:  
Microsoft Security Response Center

Edge users with Chromium engine, anywhere from Windows 10 and up.

- Especially at risk: multi-user computers, or those where untrusted users/apps might access the system.

In short

- Chromium (and therefore Edge) creates mutually isolated processes for tabs, extensions, etc.—a “sandbox.”
- CVE-2022-29144 arose because an attacker could influence the way this sandbox process was initialized, resulting in elevated permissions inside Edge.

If a user runs malicious code or a script via Edge, that code could break out of the sandbox and start fiddling with the operating system in ways it shouldn’t.

Proof-of-Concept: A Simplified Approach

While Microsoft and Google don’t publish raw exploits for browser sandboxes for safety, responsible researchers, including Project Zero, often share the general pattern.

Here’s a simplified pseudocode PoC to illustrate exploitation steps

// This is a high-level, educational example; not a weaponized exploit

// Imagine an attacker loads this via a malicious web page
function tryPrivilegeEscalation() {
    // Abuse a renderer bug to inject a fake token/process
    let fakeToken = createFakeAccessToken(SYSTEM_PRIVILEGES);

    // Request launch of a new sandboxed Edge process
    let newEdgeProcess = launchEdgeProcess({
        token: fakeToken
    });

    // Now run something with elevated access
    newEdgeProcess.run('whoami /all');  // Should only run as 'user', but now SYSTEM
}

tryPrivilegeEscalation();

Key Details

- The real-world bug involved race conditions + improper permission checks in Chromium’s sandbox broker on Windows.
- Attackers chain together a renderer bug and local privilege elevation to break out of Edge’s limited process.

Privilege Escalated:

The attacker’s code runs with SYSTEM or Administrator rights (instead of as a normal web user).

References and Further Reading

- Microsoft’s Advisory: CVE-2022-29144

- Chromium Security Notes

- Chromium Sandbox Evasion

- Example Researchers

- Google Project Zero: Browser Sandboxing
- Mitigation: Update Edge to the latest version via Official Microsoft Update Page

Conclusion

CVE-2022-29144 is a perfect example of how even major vendors like Microsoft can have holes in their software. The bug allowed crafty attackers to turn web browser sandboxes into springboards for privilege escalation, but it doesn’t mean everyday users are helpless.

Remember: The best defense is to keep your software updated and never underestimate the power of a click—especially in your browser!

Timeline

Published on: 06/29/2023 01:15:00 UTC
Last modified on: 07/07/2023 15:30:00 UTC