CVE-2024-29987: Microsoft Edge Information Disclosure Flaw

CVE-2024-29987 Overview

CVE-2024-29987 is an information disclosure vulnerability in Microsoft Edge (Chromium-based). The flaw allows a remote attacker to access sensitive information that should remain protected within the browser context. Exploitation requires user interaction, such as visiting an attacker-controlled webpage. Microsoft assigned the vulnerability CWE-359 (Exposure of Private Personal Information) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

The attack vector is network-based with low complexity and no privileges required. Successful exploitation compromises data confidentiality without impacting integrity or availability.

Critical Impact
A remote attacker can trick a user into visiting a crafted webpage that leaks sensitive information from Microsoft Edge Chromium.

Affected Products

Microsoft Edge (Chromium-based)

Discovery Timeline

2024-04-18 - CVE-2024-29987 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29987

Vulnerability Analysis

CVE-2024-29987 is classified as an information disclosure issue in Microsoft Edge (Chromium-based). The vulnerability maps to [CWE-359] (Exposure of Private Personal Information) and [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). An attacker leverages the flaw over the network to read data the browser should isolate from untrusted origins.

Exploitation depends on user interaction. A victim must load attacker-controlled content in a vulnerable Edge build for the disclosure to occur. Microsoft's advisory does not publish deep internals of the affected component, and no public proof-of-concept exists at the time of writing.

The current EPSS score is 1.203% (66th percentile), indicating a low but non-trivial probability of exploitation activity over the next 30 days.

Root Cause

The root cause resides in Microsoft Edge's Chromium-based rendering or navigation logic, where sensitive data is exposed to an unauthorized origin. Microsoft has not released implementation-level details. The CWE mapping indicates that the browser fails to enforce proper boundaries protecting private or sensitive content from unintended readers.

Attack Vector

An attacker hosts a malicious webpage or injects crafted content into an attacker-influenced site. When a user visits the page in a vulnerable version of Microsoft Edge, the browser leaks sensitive information back to the attacker. No authentication is required, and the attack traverses the network with low complexity. See the Microsoft Security Update Guide CVE-2024-29987 for authoritative details.

No verified exploitation code is available. Refer to Microsoft's advisory for the definitive technical description.

Detection Methods for CVE-2024-29987

Indicators of Compromise

Outbound requests from msedge.exe to unfamiliar domains immediately after users visit unknown web content.
Unexpected browser telemetry or diagnostic uploads triggered by newly encountered pages.
User reports of sensitive content appearing in third-party services shortly after browsing.

Detection Strategies

Inventory installed Microsoft Edge versions across managed endpoints and flag builds released before the April 2024 Edge Stable Channel security update.
Correlate browser process telemetry with newly observed domains to surface suspicious navigation chains that may exploit information disclosure flaws.
Monitor for browser child processes performing unusual file or memory access patterns during page rendering.

Monitoring Recommendations

Enable Edge enterprise diagnostic reporting and forward events to a centralized log platform for retention and search.
Track SmartScreen and Microsoft Defender for Endpoint alerts referencing phishing or malicious web content targeting Edge users.
Alert on any Edge version regressions where users downgrade below the patched build.

How to Mitigate CVE-2024-29987

Immediate Actions Required

Update Microsoft Edge (Chromium-based) to the version listed in the Microsoft Security Update Guide CVE-2024-29987.
Verify that automatic browser updates are enabled across managed endpoints via group policy or Intune.
Prioritize patching for high-risk users who handle sensitive data or browse untrusted external content.

Patch Information

Microsoft addressed CVE-2024-29987 in an Edge Stable Channel security update. Administrators should consult the Microsoft Security Update Guide CVE-2024-29987 for the exact fixed version and deployment guidance. Confirm the installed build in edge://settings/help after applying the update.

Workarounds

Restrict browsing to trusted sites using Edge's SmartScreen and enterprise site list controls until patches are deployed.
Enforce user awareness training so employees avoid clicking links from unknown senders.
Use application allowlisting to limit which browsers can run in high-risk environments.

bash

# Verify installed Microsoft Edge version on Windows endpoints
(Get-Item "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe").VersionInfo.ProductVersion

# Force Edge to check for updates via command line
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler