Threat reportVulnerabilityTL-2026-3789
CVE-2024-21388 - Microsoft Edge edgeMarketingPagePrivate API Abused for Covert Extension Installation
CVE-2024-21388 (TL-2026-3789), also tracked as edgeMarketingPagePrivate installTheme abuse, is a medium-severity software vulnerability scored CVSS 6.5, first published 2026-10-17. It has no confirmed attribution, affects Microsoft Microsoft Edge (Chromium-based), references 1 CVE (CVE-2024-21388), maps to 4 MITRE ATT&CK techniques (T1036, T1059.007, T1176.001), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 6.5/10Medium
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-3789
- Threat ID
- TL-2026-3789
- Also known as
- edgeMarketingPagePrivate installTheme abuse, Edge marketing API covert extension install
- Severity
- MEDIUM
- CVSS
- 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, enterprise, consumer
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
How CVE-2024-21388 works
Guardio Labs disclosed that the private edgeMarketingPagePrivate API in Microsoft Edge (Chromium) accepted an extension ID where a theme ID was expected, letting an attacker with JavaScript execution on allowlisted Microsoft origins silently install any extension from the Edge Add-ons store without user consent. Reported in November 2023 and fixed by Microsoft in Edge 121 (January 2024); no in-the-wild exploitation was reported.
CVE-2024-21388 is an elevation-of-privilege flaw (CWE-20, improper input validation) in Microsoft Edge (Chromium-based). Edge ships privileged private APIs that are only exposed to a hard-coded allowlist of Microsoft-controlled origins. One of them, edgeMarketingPagePrivate, was built for marketing features and exposes an installTheme() method that installs a theme from the Edge Add-ons store by ID. Guardio Labs found that the method did not verify the type of the item being installed: substituting the ID of a regular extension (plus its manifest) for a theme ID caused Edge to install the full extension silently, with no permission prompt or user interaction.
The API is reachable only from allowlisted origins: https://www.microsoft.com/*, https://www.bing.com/*, https://microsoftedgewelcome.microsoft.com/*, https://microsoftedgetips.microsoft.com/*, https://ntp.msn.com/*, https://ntp.msn.cn/*, https://localhost.msn.com/* and edge://surf/*. An attacker therefore first needs JavaScript execution in the context of one of those origins. Guardio describes two routes: an XSS flaw on a privileged domain, or a two-stage attack in which a seemingly harmless, low-privilege extension (for example one disguised as a productivity tool and holding content-script access via the <all_urls> permission) injects a script into a bing.com page. The injected script is created with createElement() as an inline script element whose src is a base64 data: URI (data:application/javascript;charset=utf-8;base64,...), which executes in the page's own context and so escapes the restricted extension content-script context. From there it calls chrome.edgeMarketingPagePrivate.installTheme(TARGET_EXTENSION_ID, TARGET_EXTENSION_MANIFEST, callback), and Edge installs the chosen extension from the Add-ons store.
Impact: the attacker can chain a low-privilege extension into installing extensions with far broader permissions, enabling spyware deployment, credential theft or financial fraud. Microsoft's advisory language notes the flaw could lead to a browser sandbox escape and that an attacker must take additional actions to prepare the target environment before exploitation (hence the Attack Complexity High rating). The researchers credited are Oleg Zaytsev of Guardio Labs and Jun Kokatsu. Microsoft fixed the issue by validating that only theme-type items can be installed through this API. Edge release notes list the fix in Stable 121.0.2277.83 (released 2024-01-26); NVD lists Edge versions prior to 121.0.2277.83 as affected, while the Guardio write-up cites 121.0.2277.98 and a February 2024 fix, so the .83 figure from NVD and Microsoft release notes is used here. Guardio published the research on 2024-03-27. No in-the-wild exploitation was reported at disclosure.
MITRE ATT&CK techniques used in TL-2026-3789
Defense Evasion
Execution
T1059.007 Command and Scripting Interpreter: JavaScript; T1204 User Execution
Persistence
Affected products and versions in CVE-2024-21388
- Microsoft — Microsoft Edge (Chromium-based)
Vulnerable versions: prior to 121.0.2277.83
Fixed in: 121.0.2277.83 (Microsoft release notes and NVD); Guardio cites 121.0.2277.98
Remediation for CVE-2024-21388
Patches
- Microsoft Edge Stable 121.0.2277.83 (released 2024-01-26) per Microsoft Edge security release notes and NVD
- Guardio cites 121.0.2277.98 as the fixed build; use the newest stable build
Immediate actions
- Update Microsoft Edge to Stable 121.0.2277.83 or later (confirm the build is current via edge://settings/help)
- Audit installed Edge extensions across the fleet and remove any that were not approved or whose install time does not match user activity
- Review extensions holding the <all_urls> permission or content-script access to bing.com and microsoft.com
Workarounds
- Block installation of unapproved extensions via ExtensionInstallBlocklist set to *
- Limit user installation of low-trust extensions that request broad host permissions such as <all_urls>
Longer-term hardening
- Enforce an Edge extension allowlist/blocklist via Group Policy (ExtensionInstallAllowlist, ExtensionInstallBlocklist) or Intune
- Monitor extension installation events and extension inventory through EDR or browser management telemetry
- Restrict extension installation to force-installed, vetted extensions only
CVEs associated with CVE-2024-21388
Weaknesses (CWE) in CVE-2024-21388
Timeline of CVE-2024-21388
- Guardio Labs (Oleg Zaytsev, Jun Kokatsu) responsibly disclosed the edgeMarketingPagePrivate flaw to Microsoft in November 2023 (exact day not published; first of month used as placeholder)
- The Hacker News cites 2024-01-25 as the release date of Edge Stable 121.0.2277.83, the fixed build, which validates that only theme-type items are installable through the private API
- Microsoft released Edge Stable 121.0.2277.83 addressing CVE-2024-21388 per Edge security release notes (THN cites 2024-01-25; Guardio cites 121.0.2277.98 and a February fix)
- NVD published CVE-2024-21388 (Edge Chromium elevation of privilege, CVSS 3.1 6.5 MEDIUM, CWE-20)
- Guardio's write-up dates the security patch to February 2024 (build 121.0.2277.98), roughly three months after the November 2023 report (exact day not published; first of month used as placeholder)
- The Hacker News and other outlets reported the flaw; Microsoft noted it could lead to a browser sandbox escape and required additional attacker preparation; no in-the-wild exploitation reported
- Guardio Labs published full technical analysis describing the installTheme() extension-ID substitution and the two-stage content-script injection path
Sources cited for CVE-2024-21388
- CVE-2024-21388 - Microsoft Edge's Marketing API Exploited for Covert Extension Installation (Guardio Labs)
- Guardio Labs (Medium mirror) - CVE-2024-21388
- Microsoft Edge Bug Could Have Allowed Hackers to Covertly Install Extensions (The Hacker News)
- NVD - CVE-2024-21388
- MSRC Security Update Guide - CVE-2024-21388
- Microsoft Edge Security Release Notes (Stable 121.0.2277.83)
- TechRadar - Edge flaw could have allowed hackers to install malicious extras
- Windows Report - Microsoft Edge CVE-2024-21388 vulnerability
- Anti-Malware.ru - Edge bug allowed silent installation of malicious extensions
- PT Security dbugs - Oleg Zaytsev researcher profile, Microsoft Edge CVE-2024-21388
Detection coverage for TL-2026-3789
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3789 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.