Microsoft probes complaints of Edge leaking URLs to Bing
(2023/04/26)
- Reference: 1682543317
- News link: https://www.theregister.co.uk/2023/04/26/microsoft_edge_url/
- Source link:
You might want to think twice before typing anything into Microsoft's Edge browser, as an apparent bug in a recent release of Redmond's Chromium clone appears to be funneling URLs you visit back to the Bing API.
The issue, identified by Redditor HackerMcHackface in the r/browsers [1]subreddit last week, appears to be related to an opt-out content aggregation feature in Edge, called Collections, which offers suggestions for online creators that users may want to follow.
However, beginning with Microsoft Edge build 112.0.1722.34, the Redditor notes that the default behavior had changed. In prior versions of Edge, they noted, the feature was limited to a subset of social media sites, including YouTube and Pinterest. Now the scope appears to be wider.
[2]
From what we can tell, it worked a bit like this: on whitelisted pages, the URL would be sent to the Bing API to determine whether a recommendation popup should be put in the browser. This recommendation would appear in the user's address bar. If the user clicks through the popup, content from that creator would then be curated in Edge's Collections feature.
[3]
[4]
However, as of the April 7, release of Edge, all URLs entered into the address bar appear to be sent to the Bing API, according to HackerMcHackface's findings.
[5]Update now: Google emits emergency fix for zero-day Chrome vulnerability
[6]Microsoft deigns to fix five-year-old Defender bug that slowed Firefox
[7]More ads in Windows 11 Start Menu could be last straw for some
[8]Google crams more AI into search as Apple, Samsung sniff around Bing
In response to questions, a Microsoft spokesperson told The Register it was "aware of reports, are investigating, and will take appropriate action to address any issues."
The Register wasn't able to independently confirm the bug. However, developer Rafael Rivera told [9]The Verge that the feature was poorly implemented and didn't appear to be functioning correctly.
If you're worried about Edge leaking every page you visit to Bing, disabling the functionality by navigating to the "Privacy, search, and services" tab on the "Settings" page and unticking "Show suggestions to follow creators in Microsoft Edge" near the bottom of the page ought to mitigate the problem. However, if you're really worried, you could always use another browser.
[10]
Despite offering a wealth of privacy toggles, Microsoft Edge hasn't always had the greatest reputation for user's privacy. In a 2020 paper, Trinity College professor Douglas Leith [11]found that Edge was among the most invasive browsers on the market, partially due to the use of hardware identifiers.
That said, Edge is hardly the only browser to run into a privacy or security breaking bug in recent history. Earlier this month, Google [12]released an emergency update to Chrome to address a zero-day vulnerability that could be exploited to hijack a user's device. ®
Get our [13]Tech Resources
[1] https://www.reddit.com/r/browsers/comments/12ysuot/edge_122_bing_now_tracking_every_page_you_visit/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZEmfAZzoACW8-rI5cCdOcAAAABA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZEmfAZzoACW8-rI5cCdOcAAAABA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZEmfAZzoACW8-rI5cCdOcAAAABA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2023/04/17/chrome_emergency_patch/
[6] https://www.theregister.com/2023/04/11/microsoft_defender_firefox_fix/
[7] https://www.theregister.com/2023/04/17/microsoft_windows_start_ads/
[8] https://www.theregister.com/2023/04/17/google_bing_ai_race/
[9] https://www.theverge.com/2023/4/25/23697532/microsoft-edge-browser-url-leak-bing-privacy
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZEmfAZzoACW8-rI5cCdOcAAAABA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2022/07/08/microsoft_grid_interactive_ups_dublin/
[12] https://www.theregister.com/2023/04/17/chrome_emergency_patch/
[13] https://whitepapers.theregister.com/
The issue, identified by Redditor HackerMcHackface in the r/browsers [1]subreddit last week, appears to be related to an opt-out content aggregation feature in Edge, called Collections, which offers suggestions for online creators that users may want to follow.
However, beginning with Microsoft Edge build 112.0.1722.34, the Redditor notes that the default behavior had changed. In prior versions of Edge, they noted, the feature was limited to a subset of social media sites, including YouTube and Pinterest. Now the scope appears to be wider.
[2]
From what we can tell, it worked a bit like this: on whitelisted pages, the URL would be sent to the Bing API to determine whether a recommendation popup should be put in the browser. This recommendation would appear in the user's address bar. If the user clicks through the popup, content from that creator would then be curated in Edge's Collections feature.
[3]
[4]
However, as of the April 7, release of Edge, all URLs entered into the address bar appear to be sent to the Bing API, according to HackerMcHackface's findings.
[5]Update now: Google emits emergency fix for zero-day Chrome vulnerability
[6]Microsoft deigns to fix five-year-old Defender bug that slowed Firefox
[7]More ads in Windows 11 Start Menu could be last straw for some
[8]Google crams more AI into search as Apple, Samsung sniff around Bing
In response to questions, a Microsoft spokesperson told The Register it was "aware of reports, are investigating, and will take appropriate action to address any issues."
The Register wasn't able to independently confirm the bug. However, developer Rafael Rivera told [9]The Verge that the feature was poorly implemented and didn't appear to be functioning correctly.
If you're worried about Edge leaking every page you visit to Bing, disabling the functionality by navigating to the "Privacy, search, and services" tab on the "Settings" page and unticking "Show suggestions to follow creators in Microsoft Edge" near the bottom of the page ought to mitigate the problem. However, if you're really worried, you could always use another browser.
[10]
Despite offering a wealth of privacy toggles, Microsoft Edge hasn't always had the greatest reputation for user's privacy. In a 2020 paper, Trinity College professor Douglas Leith [11]found that Edge was among the most invasive browsers on the market, partially due to the use of hardware identifiers.
That said, Edge is hardly the only browser to run into a privacy or security breaking bug in recent history. Earlier this month, Google [12]released an emergency update to Chrome to address a zero-day vulnerability that could be exploited to hijack a user's device. ®
Get our [13]Tech Resources
[1] https://www.reddit.com/r/browsers/comments/12ysuot/edge_122_bing_now_tracking_every_page_you_visit/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZEmfAZzoACW8-rI5cCdOcAAAABA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZEmfAZzoACW8-rI5cCdOcAAAABA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZEmfAZzoACW8-rI5cCdOcAAAABA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2023/04/17/chrome_emergency_patch/
[6] https://www.theregister.com/2023/04/11/microsoft_defender_firefox_fix/
[7] https://www.theregister.com/2023/04/17/microsoft_windows_start_ads/
[8] https://www.theregister.com/2023/04/17/google_bing_ai_race/
[9] https://www.theverge.com/2023/4/25/23697532/microsoft-edge-browser-url-leak-bing-privacy
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZEmfAZzoACW8-rI5cCdOcAAAABA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2022/07/08/microsoft_grid_interactive_ups_dublin/
[12] https://www.theregister.com/2023/04/17/chrome_emergency_patch/
[13] https://whitepapers.theregister.com/
Re: One question?
Anonymous Coward
Haven't they always done this?
Even way back before Edge when they brought out Bing if you typed in the URL to download Firefox it didn't go to that URL it performed a Bing search
Re: One question?
Omnipresent
IDK what a lot of folks think has been happening, but it's not nice stuff out there. I can tell you from experience that over exposure is simply putting you, and everything you know, at risk of attack. For goodness sake don't give the internet what you care about. It will came back like a typhoon. It's not exactly private. Grandmas giving the internet your history without knowing might be the greatest mistake of man kind.
One question?
What did you THINK was happening? These tech companies are not nice people doing nice things. They are using you. Selling you. Surveilling you. Selling you. Targeting you. It doesn't matter who the tech company is. YOU are the product.