High‑Severity Memory Corruption in Microsoft Edge and Internet Explorer (CVE‑2020‑0878) Threatens Client Browsers
What It Is
A memory‑corruption flaw in Microsoft Edge and Internet Explorer permits an attacker to execute arbitrary code in the context of the currently logged‑in user. The vulnerability is triggered by specially crafted web content that manipulates internal browser memory structures.
Exploitability
The vulnerability is rated High (CVSS ≥ 8.8). No publicly disclosed active‑exploitation campaigns have been observed, but proof‑of‑concept code exists and the attack vector is remote (via malicious web pages).
Affected Products
- Microsoft Edge (all supported versions as of 2020)
- Internet Explorer (all supported versions as of 2020)
Why It Matters for Compliance & Audit Readiness
From a control‑assurance perspective, this flaw undermines access‑control safeguards by allowing code execution under a legitimate user’s identity. Organizations must demonstrate due‑diligence through continuous vendor‑management monitoring and maintain a defensible audit trail that patches are applied promptly. Mapping this issue to the “Secure Configuration” and “Vulnerability Management” controls in frameworks such as NIST CSF or ISO 27001 strengthens evidence of a robust security posture.
Recommended Actions
- Verify that the latest security updates for Edge and Internet Explorer are deployed across all endpoints.
- Use configuration management tools to inventory browser versions and patch status.
- Map the vulnerability to the relevant access‑control and vulnerability‑management controls; capture screenshots or logs as evidence of remediation.
- Enable browser‑level mitigations (e.g., Enhanced Protected Mode, Application Guard) where applicable.
- Monitor web‑proxy and endpoint logs for anomalous script execution or exploitation attempts.
Source: https://nvd.nist.gov/vuln/detail/CVE-2020-0878