CVE-2024-20675: Microsoft Edge Chromium Auth Bypass

CVE-2024-20675 Overview

CVE-2024-20675 is a security feature bypass vulnerability in Microsoft Edge (Chromium-based). The flaw allows an attacker to circumvent a built-in security control in the browser when a user interacts with attacker-supplied content. Microsoft assigned this CVE a medium severity rating with a CVSS score of 6.3. Successful exploitation requires user interaction over the network and yields low-impact effects on confidentiality, integrity, and availability. The weakness is categorized under [CWE-284] Improper Access Control. Microsoft published guidance in the Microsoft Security Update Guide.

Critical Impact
An attacker can bypass a Microsoft Edge security feature to gain limited access to protected browser resources when a targeted user visits crafted web content.

Affected Products

Microsoft Edge (Chromium-based)

Discovery Timeline

2024-01-11 - CVE-2024-20675 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20675

Vulnerability Analysis

CVE-2024-20675 is a security feature bypass affecting the Chromium-based Microsoft Edge browser. Microsoft classifies the weakness as improper access control [CWE-284], indicating that a policy or restriction enforced by the browser can be circumvented under specific conditions. The advisory scopes the impact to limited confidentiality, integrity, and availability effects rather than remote code execution. Because exploitation runs within the browser context, attackers can chain this bypass with other web-based attack techniques to broaden impact.

Microsoft did not publish detailed root-cause information in the public advisory. Practitioners should treat the flaw as one that weakens a browser-enforced trust boundary rather than one that grants direct code execution.

Root Cause

The root cause is an improper access control condition inside Microsoft Edge that fails to consistently enforce a security feature. Microsoft has not disclosed which specific browser subsystem is affected. See the Microsoft Security Update Guide for vendor-authored technical detail.

Attack Vector

The attack vector is network-based and requires user interaction. A targeted user must load attacker-controlled content, typically by visiting a malicious URL or opening a crafted page delivered through phishing. No privileges are required on the target system, and attack complexity is low. Once the user interacts with the payload, the browser fails to enforce the intended security control and the bypass takes effect.

No public proof-of-concept or exploit code has been observed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been confirmed.

Detection Methods for CVE-2024-20675

Indicators of Compromise

Microsoft Edge builds running versions prior to the January 2024 security update addressing CVE-2024-20675.
Browser telemetry showing user navigation to newly registered or low-reputation domains immediately preceding anomalous browser behavior.
Unexpected process activity spawned from msedge.exe following interaction with untrusted web content.

Detection Strategies

Inventory installed Microsoft Edge versions across the fleet and flag hosts running outdated builds referenced in the Microsoft advisory.
Correlate web proxy logs with endpoint telemetry to identify user visits to suspicious sites followed by anomalous child process creation from the browser.
Alert on lateral file writes or credential-store access originating from Edge renderer or utility processes.

Monitoring Recommendations

Ingest browser update status into asset management to continuously track patch coverage.
Monitor endpoint detection telemetry for post-exploitation behavior sourced from browser processes.
Track threat intelligence feeds for reports of active exploitation or public proof-of-concept code targeting CVE-2024-20675.

How to Mitigate CVE-2024-20675

Immediate Actions Required

Update Microsoft Edge to the fixed build published in the Microsoft Security Update Guide.
Enable automatic browser updates through group policy or the Edge management service to prevent regression.
Reinforce user awareness training on phishing links and untrusted download prompts, since exploitation requires user interaction.

Patch Information

Microsoft addressed CVE-2024-20675 in the January 2024 Edge (Chromium-based) security update. Administrators should consult the Microsoft Security Update Guide for the exact fixed version applicable to their channel (Stable, Beta, Extended Stable) and apply the update fleet-wide.

Workarounds

No official workaround is published by Microsoft; applying the vendor update is the supported remediation.
Restrict outbound browsing to categorized, reputation-scored destinations using a secure web gateway until patching is complete.
Enforce least-privilege user accounts to limit the blast radius of any browser-based compromise.

bash

# Verify installed Microsoft Edge version on Windows
reg query "HKLM\SOFTWARE\Microsoft\Edge\BLBeacon" /v version

# Force an Edge update check via the management service
"%ProgramFiles(x86)%\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler