New Microsoft Edge Super Duper Secure Mode

by

Microsoft Edge Vulnerability Research team is experimenting with a new feature Super Duper Secure Mode, designed to bring security improvements without significant performance losses, as confirmed by Johnathan Norman, VR Lead Via Twitter. This feature is currently available for Edge Insiders, via an experimental flag in the Edge Canary, Dev, and Beta channels.

The new Microsoft Edge Super Duper Secure Mode is to disable support for Just-In-Time Compilation (JIT) inside V8, turning off the Edge browser’s JavaScript engine reducing the threat can use to hack into Edge users, help to provide a more secure & seamless browsing experience.

As per Edge Vulnerability Research (VR) team report, This reduction of attack surface has potential to significantly improve user security; it would remove roughly half of the V8 bugs that must be fixed. For users, this means less frequent security updates and fewer emergency patches required. These updates and patches are common points of frustration for our customers, particularly those in large enterprise environments who must test updates before rolling them out.

There are benefits beyond just attack surface reduction. Microsoft edge team can add several impactful mitigation technologies Controlflow-Enforcement Technology (CET), a new hardware-based exploit mitigation from Intel, Arbitrary Code Guard (ACG) that was not enabled due to the compatibility issues.

By disabling Just-In-Time Compilation (JIT) , we can enable both mitigations and make exploitation of security bugs in any renderer process component more difficult. This reduction in attack surface kills half of the bugs we see in exploits and every remaining bug becomes more difficult to exploit. To put it another way, we lower costs for users but increase costs for attackers.

Microsoft Edge team experienced that most tests see no changes with JIT disabled. There are a few improvements and regressions, but most tests remain unchanged. Based on test results, Team find that users with JIT disabled rarely notice a difference in their daily browsing and especially page load times. The chart below shows the average percentage improvement or regression in performance.

Average Improvement and Regression Chart
Credit – Microsoft Browser Vulnerability Research

Microsoft Edge Super Duper Secure Mode

You can find the feature in Edge Canary, Dev, and Beta channel. Let’s follow the below steps to try out –

  • Open Microsoft Edge.
  • To quick access Super Duper Secure Mode, type or copy and paste the following following path into the address bar and press Enter.
edge://flags
  • Type Super Duper Secure Mode in the search bar, Select the Enabled option from drop down. Once done! changes will take effect after you restart Microsoft Edge browser.
New Microsoft Edge Super Duper Secure Mode
New Microsoft Edge Super Duper Secure Mode

Microsoft seeking feedback from the community to build something of lasting value before announcing general avaiablitly of this feature. You can send your feedback through the Feedback menu or press (Alt + Shift + I) keyboard shortcut to open the Send feedback dialog in Microsoft Edge.

Resources

Leave a Comment