Microsoft Edge Security Blog

Zing! But yeah, the blog is hosted on https://microsoftedge.github.io/ which seems to be an official Microsoft account.

Some interesting research I found through serenity os suggesting jit may not be worth it for most things. https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/

The edge team have talked about it a bit in the following blog posts: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ https://microsoftedge.github.io/edgevr/posts/Introducing-Enhanced-Secu…

Yeah, static DCE is a limited optimization. I've personally given up on it. It's not useless, but it's a big lift for developers and the app size will keep growing anyway. These days I'm more interested in dynamic code paging systems as a way forward, but, at the moment I'm not able to work on that right now. Think about how "bloated" an app like Google Maps or Search is, yet it still feels fast because it downloads what it needs on demand. Everything should work that way. The Conveyor installer is a native Win32 app written in C++. It's pretty trivial, it mostly just invokes some Windows APIs, works around bugs in those and ties the results to a progress bar. It's a classic app that uses HWNDs, window messages and the like. The bulk of the logic is in one file. Despite that it's about a 500kb EXE. Where do the bytes come from? Partly, it's C++. Native code is verbose and template instantiation creates a lot of it. You don't need to instantiate many std::vectors before suddenly binary size has crept up on you. The widespread adoption of C++ increased binary sizes significantly over C, because suddenly you were using value typed containers everywhere instead of a single shared linked list utility library. GraalVM native executables start extremely fast, but they aren't small. Partly this is the mismatch problem again: operating systems don't provide stuff like built in garbage collectors, even though GC is a fundamental service nearly every app needs, so, programs ship…

> I often fall into the thinking of top 10 or 20 appstore app terms You're not the only one. As far as I can tell, the vast majority of (particularly, but not exclusively) compiler work is driven by these edge cases. As an example, when I look a the justifications for pushing undefined behavior exploitation in C, invariably some Very Smart Compiler Guy™ will state with great authority that this is absolutely essential and completely unavoidable. When you check more closely, it turns out that it enables a somewhat obscure optimisation that at best most people can do without and at worst is just about completely useless. See Proebsting's Law, which was unduly optimistic, and also some of the work on variability in benchmarking, for example how different lengths of environment variables can dwarf most optimisation effects. Daniel Bernstein stated this a bit more aggressively as "The Death of Optimising Compilers"[1]. He's not wrong, either, but when I mentioned this at a Google event, Chandler Carruth basically blew up and said it was complete garbage. Apparently he and Daniel almost came to blows over this at some conference. At the time, Google was working on a far less optimising JS runtime for Chrome, after they found out that their super-simple runtime (mostly just interpreted) for small devices was beating their super-duper sophisticated Turbofan JIT on many real world tasks. And of course Microsoft found out that just turning off the JIT completely has marginal…

I agree, this mode seems like something most people could manage without difficulty. Amusingly, my (non-Apple) system is much more locked down than this and isn't exactly unusuable IMO, although some things might be harder to manage on a phone. Microsoft did some tests for Edgium's "Super Duper Secure Mode" and found that disabling JIT improves real world performance more often than it makes it worse (and usually makes no difference): https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ Diabling JIT makes it possible to enable some additional exploit mitigation methods. A follow up article mentioned that few people who tried it noticed a difference: https://microsoftedge.github.io/edgevr/posts/Introducing-Enhanced-Secu… "It is worth mentioning that when we originally had this idea, we doubted our Microsoft Edge peers would even consider it. We quietly made changes to our browser without explicitly telling them the specifics and then asked them weeks later to see if they noticed the change. They would always say no, and only then would we inform them that we disabled the JIT. After surprising multiple developers in Microsoft Edge, we got the support needed to try this experiment. One can’t help but wonder what other well established assumptions about users and the web we should reconsider."

Google is one of only a handful of companies in this world that can fundamentally change the state of security in the tech industry. I love google and have many friends who work there, I truly believe in their mission. They have the talent and the financial resources, but sometimes they do not use those in ways that are strategically scalable IMHO. Here's some examples of ways they could use $100MM to completely flip the script on app security: 1) Google project zero - Some of the absolute best hackers in the entire world work on this team, they identify and exploit vulnerabilities at the same skill level of the best nation states. None of this significantly moves the needle. If they took this team, expanded it's skill-set, and redirected their efforts towards building protections for compilers, runtimes and framework then that would be much more impactful then showing off the next <ubiquitous software> 0day. 2) Google's partner program - Google has a program that forces all integrators of their OAuth APIs from Gmail to Gdrive to have 3rd party security assessments conducted. The 3rd parties they use put their most junior/scanner focused pentesters on those projects. The approved 3rd party vendors turn this into a cash cow because they hire kids straight out of school and bill them out at senior rates because the API integration partners are forced to use these junior teams. Instead they could create a register of ALL pentest companies and stop the SF/SV practice of…

Prompting for installation opens a dialog controlled and populated by the browser that has the name and author of the app to be installed. You can test it on the example page here, linked from the article: https://microsoftedge.github.io/Demos/pwa-install-element/index.html

Possibly, hence why the discussion regarding security in JavaScript runtimes and JIT, by completely disabling JIT execution. https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/#… Also the exact sequence of generated machine instructions depends of various factors, the same source can have various outputs, depending on code execution, preset hardware, and heuristics.

I don't think so. I just got ~2.4 for a 512KB json using JSON.stringify(data, null, 0) and ~1.4 for JSON.stringify(data). JSON.stringify(data, undefined, undefined) was the same as JSON.stringify(data). Other combos were slower https://microsoftedge.github.io/Demos/json-dummy-data/512KB.json Chrome 138.0.7204.184

>For JIT the situation is different and without JIT performance would be problematic. Not really, at least on desktops: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/#…

I would be tempted to switch to edge for the sake of "super duper secure mode" [1] but they have violated my trust in so many ways that I can't bring myself to do it. 1: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/

Trading off possible kernel bugs against letting a whole LOT of userspace software run with real root privilege Only bubblewrap would run as root, but yes this is a fair critique as this is an opinionated tradeoff. I'm considering adding a set of userns variants to give users the choice between the two. the packages have a bad security reputation By default we only enable the flathub-verified remote for this reason. Just more attack surface if you didn't remove Firefox. We're removing firefox. ... and pushing everybody into a less tested code path. Again, what is this trying to solve? Around half of V8 vulnerabilities are enabled by JIT: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/

> Imagine how slow the web would be if every piece of JavaScript needed to be analyzed by hundreds of regexes before being executed! Well, there is super duper secure mode in Edge that disables the JIT - so there's that. It also enables CET. https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/

Microsoft Edge's Lockdown Mode equivalent ships with a WASM interpreter called DrumBrake: https://microsoftedge.github.io/edgevr/posts/Introducing-Enhanced-Secu…

>performance In 2021, Microsoft added the "no JIT" option to Edge for additional security [0], and here's the quote in their blog post: >We see that most tests see no changes with JIT disabled. There are a few improvements and regressions, but most tests remain unchanged. Anecdotally, we find that users with JIT disabled rarely notice a difference in their daily browsing [0] https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode

The post links to a blog and the most recent post seems to address this concern. (I haven't actually read it yet.) https://microsoftedge.github.io/edgevr/posts/How-we-are-securing-our-n… Edit after reading: What a joke. They are using a better allocator and doing some fuzzing. This is nowhere close to the approach that Chromium uses which is basically running the PDF viewer via WASM.

Weekly news of memory related CVE. Keep using unsafe langs. What will be there in next week? CVE in Chromium? At this point betting sites should add category for that kind of games. I do wonder what people of future will think about this: "So they had research indicating that a lot of issues were related to memory, had technology which significantly reduces this issue, but they still kept doin mess for years?" https://msrc-blog.microsoft.com/2019/07/22/why-rust-for-safe-systems-p… https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ https://www.chromium.org/Home/chromium-security/memory-safety/ Memory issues and JIT (browsers) are two things that are responsible for disgusting amount of security issues

Reference to the Edge thing called "Super Duper Secure Mode" https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/

Are you on a very old iPhone model? I haven’t found disabling jit to be noticeably slower on my iPhone 13 when running iOS 16 in “Lockdown Mode”. The Microsoft Edge team has benchmarks supporting the impact is minimal on Chromium based browsers too (https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/)…

yet another JIT related vuln? c'mon, will we ever stop using JIT in browsers? Just take a look at this article from Microsoft Browser Vulnerability Research where they do challenge this and perform benchmarks without JIT >https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ >Looking at CVE (Common Vulnerabilities and Exposures) data after 2019 shows that roughly 45% of CVEs issued for V8 were related to the JIT engine.

Edge has something called "Super Duper Secure Mode" (for real) these days: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/

I didn't know about Super Duper Secure Mode. That's pretty interesting. https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/

Edge did some benchmarks with their "Super Duper Secure Mode" and found that disabling JIT improves performance more often than not: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/

According to this analysis from Mozilla, over half of "in the wild" exploited vulnerabilities in chrome use bugs in the javascript JIT compiler. https://docs.google.com/spreadsheets/d/1FslzTx4b7sKZK4BR-DpO45JZNB1QZF… https://docs.google.com/spreadsheets/d/1FslzTx4b7sKZK4BR-DpO45JZNB1QZF… (these links were found here https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/) So it does appear that there is a fairly heavy connection between the two things. I am not an expert in JITs or JIT related security issues, but from my understanding, since JITs get to bypass the normal W^X memory restrictions, it makes it a really nice target for exploits and RCE.

I found this comparison of JIT vs non-JIT. https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ If you take those charts at face value, they're pretty incredible. The JIT ends up worse than the interpreter for most (real-world non-synthetic) use cases for power usage, memory usage, and startup time. Page load time is a wash. And this is after Google has poured $billions into optimizing V8.

Microsoft has added some mitigtions to Edge a few months ago as defense in depth - wondering now if this is actually exploitable on Edge or if their mitigations prevent it? Any Microsoft/Edge security people on here? Update: found the original blog from Microsoft, they call it Super Duper Secure Mode: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/

Technically correct. Also related: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ Most Browser exploits these days use Heap Spraying attacks that try to corrupt the state of the sandbox in between bindings and native libraries (or their data structures that are transferred between contexts). So technically, a JIT VM always leads to possibilities for breakouts when there is a discrepancy between the optimizer and deoptimizer's assumptions (e.g. in regards to callstack, garbage, memory ownership etc). Also: There's a legacy navigator.plugins C-Bridge based API which hasn't been maintained or redesigned/refactored since the late 90s yet it is still active in most Browsers.

Microsoft took a somewhat similar approach with their “ Super Duper Secure Mode” in Edge. It disables the JIT in the V8 JavaScript engine to reduce the attack area of the browser: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/

As an interesting related data point. Edge has a mode with no JIT and it might be usable for a lot of practical scenarios: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ Our current software is designed around a particular set of operations being the "expensive" ones. Maybe other configurations are workable too, with enough rearchitecting. For example, Singularity IPC looks like it should have about the same cost as a typical userspace dynamic library function call. (IMO the main problem with Singularity's approach is instead that it leaves everything wide open to Spectre...)