"Alongside PartitionAlloc, we ensured that a suite of additional technical countermeasures, also already used across Microsoft Edge, were compatible with the new PDF stack. Microsoft also details its own contributions to Edge security mitigations. "This unique heap implementation provides a rapid understanding of vulnerabilities and a strong layer of protection that the new PDF stack will benefit from," Microsoft says. All of these help mitigate memory flaws like use-after frees, but they also create a performance overhead. This includes using security features developed by Google's Chromium team to mitigate C++-related memory flaws, including the relatively recent add-ons for MiraclePtr and heap memory scanning, as well as PartitionAlloc, Chromium's memory allocator. It says the Microsoft Edge Vulnerability Research team was "heavily involved" in the process of bringing the Acrobat engine into Edge.
Microsoft detailed some of the work it's done to secure the browser's PDF stack. Turner claims that "using the free PDF experience with the Adobe engine will not allow Adobe to collect any data from you."
0 kommentar(er)
