CVE-2024-21387 Overview
CVE-2024-21387 is a spoofing vulnerability affecting Microsoft Edge (Chromium-based) on Android. The flaw allows a remote attacker to manipulate security-relevant user interface elements over the network without authentication or user interaction. Successful exploitation can mislead users into trusting attacker-controlled content, undermining browser trust indicators.
Microsoft classifies the issue under CWE-357: Insufficient UI Warning of Dangerous Operations, reflecting inadequate visual cues when handling potentially unsafe operations. The vulnerability impacts integrity only and does not expose confidential data or affect availability directly.
Critical Impact
Attackers can spoof trusted UI elements in Microsoft Edge for Android to conduct phishing or social engineering campaigns against mobile users.
Affected Products
- Microsoft Edge (Chromium-based) for Android
- Microsoft Edge Chromium Stable channel builds prior to the patched release
- Microsoft Edge Chromium Extended Stable channel builds prior to the patched release
Discovery Timeline
- 2024-01-26 - CVE-2024-21387 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-21387
Vulnerability Analysis
The vulnerability resides in Microsoft Edge's Chromium-based browser on the Android platform. It falls under the category of Mobile App Vulnerability, specifically a User Interface Confusion issue tracked as CWE-357. The browser fails to present sufficient warnings or trust indicators when rendering certain content, enabling an attacker to disguise malicious pages as legitimate.
The attack vector is network-based and requires no privileges or user interaction beyond visiting a crafted resource. Because the flaw affects only integrity, an attacker cannot directly read data or crash the browser. Instead, exploitation supports downstream phishing, credential harvesting, or drive-by social engineering.
Root Cause
The root cause is insufficient UI warning logic in the Android build of Edge Chromium. Trust-relevant indicators such as address bar contents, URL origins, or security prompts can be rendered in a way that misrepresents the true source of content. This allows attacker-controlled data to appear as though it originates from a trusted origin.
Attack Vector
An attacker hosts a malicious web page or delivers a crafted link through email, messaging, or advertising. When a mobile user opens the link in Microsoft Edge for Android, the browser displays misleading UI that impersonates a legitimate site. The user may then submit credentials, download files, or approve actions believing them safe.
No authentication or local access is required, and the flaw is exploitable purely over the network. See the Microsoft Security Update Guide for vendor technical details.
Detection Methods for CVE-2024-21387
Indicators of Compromise
- Unusual outbound connections from Android devices to newly registered or typosquatted domains rendered through Edge.
- User reports of address bar or site identity indicators that do not match the expected destination.
- Credential submissions to unexpected origins traced back to Edge browsing sessions on Android.
Detection Strategies
- Monitor mobile web traffic through secure web gateways for known phishing infrastructure and low-reputation domains.
- Correlate Edge for Android version telemetry from mobile device management with vulnerable build ranges.
- Inspect user-reported phishing submissions for URLs delivered specifically to Android Edge clients.
Monitoring Recommendations
- Enable telemetry from mobile threat defense agents to flag browser-based phishing behavior on managed Android devices.
- Track Edge browser version compliance across the Android fleet through enterprise mobility management dashboards.
- Review DNS and proxy logs for repeated requests from Android endpoints to domains resembling internal corporate services.
How to Mitigate CVE-2024-21387
Immediate Actions Required
- Update Microsoft Edge for Android to the latest version available through the Google Play Store.
- Enforce minimum browser version policies through mobile device management to block outdated Edge installations.
- Reinforce user awareness training focused on mobile phishing and verifying URLs before submitting credentials.
Patch Information
Microsoft has addressed the vulnerability in updated builds of Microsoft Edge for Android. Refer to the Microsoft Security Update Guide entry for CVE-2024-21387 for the specific fixed version and release notes. Deploy the patched version through Google Play or managed app distribution channels.
Workarounds
- Restrict use of Microsoft Edge on Android to patched versions through conditional access policies.
- Route mobile browsing through an enterprise secure web gateway that blocks known phishing domains.
- Enable Microsoft Defender SmartScreen or equivalent protections in Edge to warn on suspicious sites.
# Example: enforce minimum Edge for Android version via Microsoft Intune app protection policy
# Configure App Protection Policy > Conditional launch > Min app version
# App: com.microsoft.emmx
# Min version: <patched version from MSRC advisory>
# Action: Block access
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
