CVE-2024-29991: Microsoft Edge Chromium Auth Bypass

CVE-2024-29991 Overview

CVE-2024-29991 is a security feature bypass vulnerability in Microsoft Edge (Chromium-based). The flaw allows an attacker to circumvent a browser security control when a targeted user interacts with attacker-controlled content over the network. Microsoft published the advisory through the Microsoft Security Response Center (MSRC), and the issue is tracked under [CWE-94] (Improper Control of Generation of Code) alongside NVD-CWE-noinfo.

Exploitation requires user interaction and high attack complexity, which limits opportunistic abuse. The vulnerability is relevant to enterprises that rely on Edge's built-in protections for browsing, extension handling, and downloaded content.

Critical Impact
A successful bypass weakens Edge's security boundary and can enable subsequent attacks such as code injection or delivery of malicious payloads that would normally be blocked by the browser.

Affected Products

Microsoft Edge (Chromium-based) - all versions prior to the patched build
Windows deployments running vulnerable Edge builds
macOS deployments running vulnerable Edge builds

Discovery Timeline

2024-04-19 - CVE-2024-29991 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29991

Vulnerability Analysis

CVE-2024-29991 is classified as a security feature bypass in the Chromium-based Microsoft Edge browser. The issue is mapped to [CWE-94], which covers improper control of code generation, indicating that the affected code path fails to enforce an intended restriction on how content is processed or executed within the browser context.

The attack is network-based and requires the victim to perform an action, typically visiting a crafted web page. High attack complexity indicates that the attacker must satisfy specific preconditions outside their direct control, such as timing, race windows, or particular browser state. Once triggered, the bypass produces limited impact to confidentiality, integrity, and availability, but it removes a security control that other exploits may depend on.

Root Cause

Microsoft has not published a detailed technical root-cause analysis. Based on the [CWE-94] mapping and the security feature bypass classification, the underlying defect involves insufficient validation or enforcement in a code path that governs how untrusted content is handled inside the Edge renderer or associated components. See the Microsoft Vulnerability Update CVE-2024-29991 advisory for vendor-supplied details.

Attack Vector

An attacker hosts malicious content on a web resource they control or on a compromised site. A user browsing with a vulnerable version of Microsoft Edge visits the page and interacts with it. The crafted content triggers the bypass, disabling or evading a security check that Edge would ordinarily enforce. The attacker can then chain the bypass with additional payloads to expand impact beyond what the browser's baseline defenses would permit.

No public proof-of-concept exploit is listed for this CVE, and it is not currently tracked in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability score reflects a low expected likelihood of exploitation in the wild.

Detection Methods for CVE-2024-29991

Indicators of Compromise

Microsoft Edge processes (msedge.exe) launching unexpected child processes such as powershell.exe, cmd.exe, or script hosts shortly after browsing sessions
Unusual file writes by Edge into user profile directories or %TEMP% immediately following navigation to unfamiliar domains
Outbound network connections from Edge to newly registered or low-reputation domains delivering script-heavy content

Detection Strategies

Inventory installed Edge versions across the fleet and flag hosts still running builds prior to the vendor patch referenced in the MSRC advisory
Monitor browser telemetry for anomalous renderer behavior, unexpected extension loads, or unsigned content execution originating from the Edge process tree
Correlate web proxy logs with endpoint execution telemetry to identify sessions where a browsed URL preceded suspicious child process activity

Monitoring Recommendations

Enable centralized collection of browser and endpoint telemetry to support retroactive hunting when new indicators emerge
Alert on Edge processes spawning interpreters or performing LOLBin execution within a short time window after navigation events
Track Edge update compliance as a recurring metric within vulnerability management dashboards

How to Mitigate CVE-2024-29991

Immediate Actions Required

Update Microsoft Edge to the fixed version listed in the MSRC advisory for CVE-2024-29991
Verify that Edge auto-update is enabled and functioning on all managed endpoints
Restrict browsing to trusted sites for high-risk user groups until patches are confirmed deployed

Patch Information

Microsoft addressed CVE-2024-29991 in a Microsoft Edge (Chromium-based) security update. Administrators should consult the Microsoft Vulnerability Update CVE-2024-29991 advisory for the specific fixed build number and apply the update through Microsoft Update, WSUS, Intune, or the standalone Edge update channel.

Workarounds

Deploy Edge group policies to disable high-risk features and enforce Enhanced Security Mode until patching completes
Use web filtering to block access to untrusted or newly registered domains that commonly host exploit content
Educate users to avoid interacting with unsolicited links, since exploitation requires user interaction

bash

# Verify installed Microsoft Edge version on Windows via PowerShell
(Get-Item "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe").VersionInfo.ProductVersion

# Force Edge to check for updates via the command line
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler