# Guest Blog Post - Memory corruption vulnerabilities in Edge

Multiple UAF/OOB-read bugs in Edge-specific browser-process features (web app install dialog, web capture, guided switch, mini menu, group editor, JS dialog) yielding crashes and potential memory corruption.

- Payout: $215,000
- Severity: high
- Program: Microsoft
- Credited: David Erceg
- Disclosed: 2022-10-17
- Write-up quality: 8/10
- Original: https://microsoftedge.github.io/edgevr/posts/memory-corruption-vulnerabilities-in-edge/
- Library page: https://bugbountylibrary.com/r/blog%3Amicrosoftedge-github-io-edgevr-posts-memory-corruption-vulnerabilities-in-edge
- Tags: domain:browser impact:dos kind:bounty platform:blog sev:high tech:chromium technique:incomplete-fix technique:regression technique:reverse-engineering technique:source-review vuln:dos vuln:memory-corruption

**Target:** Edge browser process (msedge.dll) UI features: web app install dialog, web capture, guided switch, mini menu, tab group editor, JS dialogs
**Root cause:** Asynchronous operations and dialogs outlive the objects they reference (raw this captured in PostTaskAndReply, unmatched BrowserList::AddObserver/RemoveObserver, missing end() checks on frame/iterator vectors), causing use-after-free and out-of-bounds reads.
**Steps:**
1. Web app icon UAF: open Apps > Install this site as an app, click Edit to open file picker, navigate/close the tab to destroy the dialog, then select a file -> UAF in EdgeWebAppCustomIcon::OnEditIconButtonPressed
2. Web capture OOB: load a read: page with a single frame (e.g. `read://_/?url=` or `view-source:read:...`), trigger web capture -> OOB read iterating frames vector without end check
3. Guided switch UAF: load https://login.live.com/ in a second profile to show dialog, move tab to another window, close original window, trigger a BrowserList event -> UAF from unmatched RemoveObserver
4. Mini menu UAF: select text to show mini menu, close the tab, then select a menu item -> UAF
5. Group editor OOB: enable vertical tabs, group a tab, open group editor bubble, delete group via extension, select a bubble menu item -> OOB read
6. Drag OOB: close a window (brief no-tab state) while dragging a link over the tab strip -> OOB read in EdgeTabStrip::GetDropBounds
7. JS dialog UAF: show a JS dialog, move it to another window, close original window, close dialog -> UAF in BrowserView::RemoveFocusDialog
8. Verify with Ghidra (load msedge.dll + PDB, decompile) and WinDbg (breakpoints on ctor/dtor, data breakpoints `ba w8 <addr>`, TTD) since no ASan builds exist for Edge
**How found:** Hunting Edge-specific fork features (web app install, web capture, guided switch, mini menu, vertical tabs) and testing async/dialog lifetime: closing tabs/windows/dialogs mid-operation, moving dialogs between windows, deleting extension-modifiable data while bubbles are shown. Also checked whether Chromium fixes (e.g. 1209616, 1228557) still reproduce in Edge due to overridden methods, and used weggli AST queries to find iterator dereferences lacking end() checks.
**Exploitation:** No weaponization described; issues manifest as browser-process crashes (UAF/OOB read) with potential for memory corruption exploitation in the privileged browser process.
**Insight:** In Chromium forks, re-test upstream-fixed bugs against fork-overridden methods (EdgeTabStrip::GetDropBounds overriding TabStrip::GetDropBounds kept the bug alive), and target fork-only UI features; for lifetime bugs, close/move the tab or window while an async file picker, background image task, or dialog is in flight, and grep for base::Unretained(this) in PostTaskAndReply plus unmatched AddObserver/RemoveObserver pairs.