14 DAY TRIAL // SmartScreen is one of the security features that Microsoft is offering in Edge browser to warn of websites that are flagged as dangerous for users’ computers, but a security researcher has discovered that cybercriminals can abuse this feature to deliver false warnings.
Manuel Caballero explains in a blog post that Microsoft Edge has a vulnerability that allows ms-appx: and ms-appx-web: commands to generate fake alerts very similar to the one issued by SmartScreen and which could be used in more complex schemes.
For example, the attackers can use these warnings to convince unsuspecting victims to call a phone number, where phone scammers would attempt to steal users’ information.
“As a bonus, when we place a telephone-like number, a link is automatically created so the user can call us with a single click. Very convenient for these scammers,” the researcher notes.
Microsoft’s SmartScreen
SmartScreen is a feature that’s available in both Microsoft Edge and Internet Explorer, but this bug has been demonstrated only in the default Windows 10 browser.
In essence, SmartScreen is a super helpful feature that keeps users protected from websites that could be used to spread malware.
“SmartScreen checks the sites you visit against a dynamic list of reported phishing sites and malicious software sites. If it finds a match, SmartScreen will show you a warning letting you know that the site has been blocked for your safety,” Microsoft explains.
Microsoft is working hard to improve browser security in Edge, so it goes without saying that this is going to be fixed for sure in the coming updates.
Edge receives updates on a regular basis and large OS updates, such as the upcoming Creators Update, bring a plethora of improvements for the browser, including features and fixes that are specifically supposed to make the app faster, more reliable and more secure.