MS EDGE XSS Vulnerability

Microsoft rolled out updates for the Edge browser with fixes for two security issues, one of which concerns a security bypass vulnerability that could be exploited to inject and execute arbitrary code in the context of any website.

Tracked as CVE-2021-34506 , the weakness stems from a universal cross-site scripting (UXSS) issue that’s triggered when automatically translating web pages using the browser’s built-in feature via Microsoft Translator.

Unlike the common XSS attacks, UXSS is a type of attack that exploits client-side vulnerabilities in the browser or browser extensions in order to generate an XSS condition, and execute malicious code.When such vulnerabilities are found and exploited, the behavior of the browser is affected and its security features may be bypassed or disabled.

This inturn allowing an attacker to potentially insert malicious JavaScript code anywhere in the webpage that’s then subsequently executed when the user clicks the prompt on the address bar to translate the page.

Microsoft fixed the issue, in addition to awarding the researchers $20,000 as part of its bug bounty program.The latest update (version 91.0.864.59) to the Chromium based browser.