An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser, aka "Microsoft Edge Elevation of Privilege Vulnerability." This CVE ID is unique from CVE-2017-0241.
Existe una vulnerabilidad de elevación de privilegios en Microsoft Edge que podría permitir a un atacante escapar de la caja de seguridad de AppContainer en el navegador, también conocida como "Vulnerabilidad de elevación de privilegios de borde de Microsoft". Este CVE ID es exclusivo de CVE-2017-0241.
This vulnerability allows remote attackers to escape the AppContainer sandbox on vulnerable installations of Microsoft Edge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the implementation of the IBrowserBroker::WriteClassesOfCategory method. Executing this method can cause the broker process to load a module from an unqualified path. An attacker can leverage this in conjunction with other vulnerabilities to execute code under the context of the user at medium integrity.
