A security feature bypass vulnerability exists in Edge that allows for bypassing Mark of the Web Tagging (MOTW). Failing to set the MOTW means that a large number of Microsoft security technologies are bypassed. In a web-based attack scenario, an attacker could host a malicious website that is designed to exploit the security feature bypass. Alternatively, in an email or instant message attack scenario, the attacker could send the targeted user a specially crafted .url file that is designed to exploit the bypass. Additionally, compromised websites or websites that accept or host user-provided content could contain specially crafted content to exploit the security feature bypass. However, in all cases an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could entice a user to either click a link that directs the user to the attacker's site or send a malicious attachment. The security update addresses the security feature bypass by correcting how Edge handles MOTW tagging.
This vulnerability carries a MEDIUM severity rating with a CVSS v3.1 score of 5.0, indicating it can be exploited remotely over the network but requires specific conditions to be met though user interaction is required and does not require pre-existing privileges . The vulnerability impacts limited data confidentiality, limited integrity, and limited availability for affected systems. Impacting 4 products from microsoft, from microsoft, from microsoft and 1 other, organizations running these solutions should prioritize assessment and patching.
First disclosed in 2019, this vulnerability was reported during a period defined by widespread IoT adoption challenges, mobile security concerns, and the emergence of advanced persistent threat (APT) techniques. Contemporary mitigation strategies focused on secure development practices and third-party component vetting.
2019-06-12T14:29:04.133
2025-05-20T18:15:41.870
Modified
CVSSv3.1: 5.0 (MEDIUM)
AV:N/AC:H/Au:N/C:P/I:P/A:P
4.9
6.4
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | microsoft | edge | - | Yes |
| Operating System | microsoft | windows_10 | 1607 | No |
| Operating System | microsoft | windows_10 | 1703 | No |
| Operating System | microsoft | windows_10 | 1709 | No |
| Operating System | microsoft | windows_10 | 1803 | No |
| Operating System | microsoft | windows_10 | 1809 | No |
| Operating System | microsoft | windows_10 | 1903 | No |
| Operating System | microsoft | windows_server_2016 | - | No |
| Operating System | microsoft | windows_server_2019 | - | No |
SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For microsoft's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.