Is JIT the source of all evils? Microsoft begins to test Edge Super Safe Mode

Microsoft recently introduced a new program called “Super Duper Secure Mode (Super Duper Secure Mode, SDSM)” to improve the Edge browser. The JavaScript engine V8, which is considered the culprit of web hacking, is a “JIT compiler (just-in-time)”.

The V8 engine is a JavaScript engine used by Google Chrome. The JIT compiler was originally used to improve the performance of JavaScript. However, according to the Microsoft Browser Vulnerability Research Project report, 45% of CVEs related to the V8 engine have been associated with JIT since 2019, according to the “CVE General Vulnerabilities and Exposures” database data. The Mozilla Foundation’s analytics report that more than half of unrelated chrome vulnerabilities are still highly exploited by JIT errors and malicious components.

Edge has introduced a super secure testing method, which is simply the Migration JIT compiler. Suggests that after Microsoft removes the JIT, half of the V8 engine errors that need to be connected can be removed. For users, this means frequent security updates and minimizing emergency repairs.

Microsoft Attack refers to removing the JIT in addition to reducing the surface area. For example, you can use some intrusion mitigation technologies that are not based on the V8 engine’s working method, such as those developed by IntelIn terms of hardwareControlled flow activation technology (CET), and arbitrary code protection (ACG) technology.

Of course, everyone is worried that the browser performance will be greatly reduced. After hundreds of actual websites and displays from Microsoft, they tested memory usage, webpage loading time, startup and power consumption, and even though JIT was disabled most users were unaware of it in everyday use. Although this may affect the reading time of the webpage, start-up time is reduced.

Over the next few months Microsoft will continue to test SuperSap mode, and now it will enable CET by disabling JIT first. But for now, this method does not support WebAssembly (WASM). After testing and testing over the next few months, Microsoft hopes that it will slowly develop new mitigation measures and re-add WASM support. In the three-level test versions of Edge Canary, Dev and Beta, you will find the switch to Super Sap mode until you enter the Edge: // flags.

Download Edge Beta: Click here