# CVE-2024-21388 - Microsoft Edge edgeMarketingPagePrivate API Abused for Covert Extension Installation

> Guardio Labs disclosed that the private edgeMarketingPagePrivate API in Microsoft Edge (Chromium) accepted an extension ID where a theme ID was expected, letting an attacker with JavaScript execution on allowlisted Microsoft origins silently install any extension from the Edge Add-ons store without user consent. Reported in November 2023 and fixed by Microsoft in Edge 121 (January 2024); no in-the-wild exploitation was reported.

- **Published:** 2026-10-17T00:01:03Z
- **Last reviewed:** 2026-10-17T00:01:03Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3789
- **ID:** TL-2026-3789
- **Severity:** MEDIUM (CVSS 6.5)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-21388

## Description

CVE-2024-21388 is an elevation-of-privilege flaw (CWE-20, improper input validation) in Microsoft Edge (Chromium-based). Edge ships privileged private APIs that are only exposed to a hard-coded allowlist of Microsoft-controlled origins. One of them, edgeMarketingPagePrivate, was built for marketing features and exposes an installTheme() method that installs a theme from the Edge Add-ons store by ID. Guardio Labs found that the method did not verify the type of the item being installed: substituting the ID of a regular extension (plus its manifest) for a theme ID caused Edge to install the full extension silently, with no permission prompt or user interaction.

The API is reachable only from allowlisted origins: https://www.microsoft.com/*, https://www.bing.com/*, https://microsoftedgewelcome.microsoft.com/*, https://microsoftedgetips.microsoft.com/*, https://ntp.msn.com/*, https://ntp.msn.cn/*, https://localhost.msn.com/* and edge://surf/*. An attacker therefore first needs JavaScript execution in the context of one of those origins. Guardio describes two routes: an XSS flaw on a privileged domain, or a two-stage attack in which a seemingly harmless, low-privilege extension (for example one disguised as a productivity tool and holding content-script access via the <all_urls> permission) injects a script into a bing.com page. The injected script is created with createElement() as an inline script element whose src is a base64 data: URI (data:application/javascript;charset=utf-8;base64,...), which executes in the page's own context and so escapes the restricted extension content-script context. From there it calls chrome.edgeMarketingPagePrivate.installTheme(TARGET_EXTENSION_ID, TARGET_EXTENSION_MANIFEST, callback), and Edge installs the chosen extension from the Add-ons store.

Impact: the attacker can chain a low-privilege extension into installing extensions with far broader permissions, enabling spyware deployment, credential theft or financial fraud. Microsoft's advisory language notes the flaw could lead to a browser sandbox escape and that an attacker must take additional actions to prepare the target environment before exploitation (hence the Attack Complexity High rating). The researchers credited are Oleg Zaytsev of Guardio Labs and Jun Kokatsu. Microsoft fixed the issue by validating that only theme-type items can be installed through this API. Edge release notes list the fix in Stable 121.0.2277.83 (released 2024-01-26); NVD lists Edge versions prior to 121.0.2277.83 as affected, while the Guardio write-up cites 121.0.2277.98 and a February 2024 fix, so the .83 figure from NVD and Microsoft release notes is used here. Guardio published the research on 2024-03-27. No in-the-wild exploitation was reported at disclosure.

## MITRE ATT&CK

- T1204 User Execution
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1176.001 Software Extensions: Browser Extensions
- T1036 Masquerading

## Sources

- [CVE-2024-21388 - Microsoft Edge's Marketing API Exploited for Covert Extension Installation (Guardio Labs)](https://guard.io/labs/cve-2024-21388-microsoft-edges-marketing-api-exploited-for-covert-extension-installation-879fe5ad35ca)
- [Guardio Labs (Medium mirror) - CVE-2024-21388](https://labs.guard.io/cve-2024-21388-microsoft-edges-marketing-api-exploited-for-covert-extension-installation-879fe5ad35ca)
- [Microsoft Edge Bug Could Have Allowed Hackers to Covertly Install Extensions (The Hacker News)](https://thehackernews.com/2024/03/microsoft-edge-bug-could-have-allowed.html)
- [NVD - CVE-2024-21388](https://nvd.nist.gov/vuln/detail/CVE-2024-21388)
- [MSRC Security Update Guide - CVE-2024-21388](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21388)
- [Microsoft Edge Security Release Notes (Stable 121.0.2277.83)](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security)
- [TechRadar - Edge flaw could have allowed hackers to install malicious extras](https://www.techradar.com/pro/security/this-microsoft-edge-security-flaw-could-have-allowed-hackers-to-install-all-kinds-of-malicious-extras-but-theres-good-news)
- [Windows Report - Microsoft Edge CVE-2024-21388 vulnerability](https://windowsreport.com/microsoft-edge-cve-202421388-vulnerability/)
- [Anti-Malware.ru - Edge bug allowed silent installation of malicious extensions](https://www.anti-malware.ru/news/2024-03-27-111332/43045)
- [PT Security dbugs - Oleg Zaytsev researcher profile, Microsoft Edge CVE-2024-21388](https://dbugs.ptsecurity.com/researchers/Oleg%20Zaytsev)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3789