--- title: “CVE-2024-21388”- Microsoft Edge’s Marketing API... description: Guardio Labs discovered a vulnerability in Microsoft Edge's marketing API that allowed covert installation of browser extensions with broad permissions. The... canonical: https://daily.dev/posts/cve-2024-21388---microsoft-edge-s-marketing-api-exploited-for-covert-extension-installation-dp8ycejyu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: “CVE-2024-21388”- Microsoft Edge’s Marketing API Exploited for Covert Extension Installation | daily.dev og:description: Guardio Labs discovered a vulnerability in Microsoft Edge's marketing API that allowed covert installation of browser extensions with broad permissions. The... og:url: https://daily.dev/posts/cve-2024-21388---microsoft-edge-s-marketing-api-exploited-for-covert-extension-installation-dp8ycejyu og:image: https://api.daily.dev/og/posts/DP8ycEJyU.png og:image:alt: “CVE-2024-21388”- Microsoft Edge’s Marketing API Exploited for Covert Extension Installation og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # “CVE-2024-21388”- Microsoft Edge’s Marketing API Exploited for Covert Extension Installation **[Guardio](https://daily.dev/sources/guardio)** · 9 min read · 0 upvotes · 0 comments ## Summary Guardio Labs discovered a vulnerability in Microsoft Edge's marketing API that allowed covert installation of browser extensions with broad permissions. The issue was promptly disclosed to Microsoft and resolved in February 2024. The vulnerability was due to a private API accessible from select Microsoft websites that allowed the installation of extensions without user consent. The exploitation of this vulnerability could lead to the installation of malicious extensions and potential monetary gain for attackers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#microsoft-edge](https://daily.dev/tags/microsoft-edge) [View this post on daily.dev](https://daily.dev/posts/cve-2024-21388---microsoft-edge-s-marketing-api-exploited-for-covert-extension-installation-dp8ycejyu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"“CVE-2024-21388”- Microsoft Edge’s Marketing API Exploited for Covert Extension Installation","url":"https://daily.dev/posts/cve-2024-21388---microsoft-edge-s-marketing-api-exploited-for-covert-extension-installation-dp8ycejyu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cve-2024-21388---microsoft-edge-s-marketing-api-exploited-for-covert-extension-installation-dp8ycejyu"},"datePublished":"2024-03-27T14:10:07.340Z","dateModified":"2024-05-09T08:29:02.242Z","description":"Guardio Labs discovered a vulnerability in Microsoft Edge's marketing API that allowed covert installation of browser extensions with broad permissions. The...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/629e530f16034b819c7f488a8f6395b9?_a=AQAEufR","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/629e530f16034b819c7f488a8f6395b9?_a=AQAEufR","isAccessibleForFree":true,"articleSection":"Guardio","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Guardio","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/2941f5631fa34e6e9c12b27b9bc5bc0e","url":"https://daily.dev/sources/guardio"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cve-2024-21388---microsoft-edge-s-marketing-api-exploited-for-covert-extension-installation-dp8ycejyu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"microsoft-edge","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Guardio","item":"https://daily.dev/sources/guardio"},{"@type":"ListItem","position":3,"name":"“CVE-2024-21388”- Microsoft Edge’s Marketing API Exploited for Covert Extension Installation"}]} ```