Proxy Execution with Microsoft Edge WebView2 - Matthew Eidelberg
Source: YouTube · Black Hills Information Security · published Jul 10, 2026 · 1:09:02
This webcast reveals a critical design flaw in Microsoft's Windows Apps ecosystem: despite being sandboxed containers designed to prevent legacy DLL attacks, they remain highly vulnerable to DLL sideloading due to an external dependency on MS Edge WebView2 12:00-12:05.
Key Takeaways:
• Windows Apps are secure, sandboxed containers that restrict write access to TrustedInstaller, effectively mitigating traditional DLL hijacking and sideloading attacks 10:50-11:32.
• The vulnerability stems from domain_actions.dll, a critical WebView2 component that lives outside the sandbox in a user-writable AppData path and is required for core OS and business apps (Outlook, Teams, Search) to function 13:35-14:52.
• Attackers can exploit this by renaming the legitimate DLL, dropping a malicious proxy DLL, and achieving persistent code execution under the context of trusted applications, entirely bypassing application allowlisting 20:02-22:34.
• After a six-month disclosure process, Microsoft reclassified the issue below the CVE threshold days before a planned Patch Tuesday, leaving it as an unpatched "Forever Day" vulnerability in Windows 10 and 11 32:13-34:02.
• Defenders should focus on behavioral detections in AppData, monitoring for unsigned DLLs, recent compile times, or anomalous file hashes rather than relying on static block lists that would break critical business tools 37:32-38:11.
Because Microsoft currently has no plans to patch this architectural flaw, organizations must implement proactive behavioral monitoring to detect these sideloading techniques and reduce attacker dwell time.
Sources:
- 10:50-11:32 Explanation of Windows Apps security boundaries and TrustedInstaller controls
- 12:00-12:05 Introduction of the MS Edge WebView2 dependency flaw
- 13:35-14:52 Discovery of domain_actions.dll outside the sandbox in AppData
- 20:02-22:34 Weaponization demonstration using Outlook and proxy DLLs
- 32:13-34:02 Details on the failed 6-month Microsoft disclosure and "Forever Day" classification
- 37:32-38:11 Recommended defensive detections focusing on compile times, signatures, and hashes
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
All right. Hello everybody. Welcome to the BHIS webcast for today. We've got Matthew Idleberg here. He's going to talk to us about Microsoft stuff cuz I keep forgetting exactly what the title is, but he's going to tell us anyway in just a moment. I'm going to go backstage and at the end of the webcast, we're going to come back. We're going to talk about questions that may have come up and maybe more food stuff or not. But anyway, it's all yours, Matthew. Take it away. Thank you. Let's get started. So the title is proxy execution using or with MS Edge web view 2. So we're going to kind of talk about a lot of concepts today, some old, some new, and the kind of bridge between them. So of course, as I mentioned, some olds. We're going to kind of recap DLL attacks just to level set the knowledg…