Bypassing Mitigations by Attacking JIT Server in Microsoft Edge
Summary: With the Windows 10 Creators Update, Microsoft introduced Arbitrary Code Guard in Microsoft Edge, which blocks allocating new executable memory or modifying existing executable memory in a Content Process. Because JIT compilation of JavaScript is incompatible with ACG, Microsoft moved the JIT engine into a separate JIT Process, and Project Zero's Ivan Fratric analyzed that implementation and uncovered multiple issues in it, since fixed at the time of publication.
Key Takeaway: The mitigation Microsoft built to stop an attacker with a foothold in the browser's Content Process from executing arbitrary code depended on a new out-of-process JIT server, and Project Zero found multiple issues in that server - a reminder that the isolation layer protecting your browser is itself attack surface.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026