Windows Defender Application Control Bypassed Using Operationalizing Browser Exploits

Researchers have uncovered a sophisticated technique to bypass Windows Defender Application Control (WDAC), a critical Windows security feature designed to prevent unauthorized code execution. The bypass leverages vulnerabilities in trusted Electron applications, effectively circumventing one of Microsoft’s most robust security mechanisms aimed at high-assurance environments. By exploiting the underlying V8 JavaScript engine used in these […] The post Windows Defender Application Control Bypassed Using Operationalizing Browser Exploits appeared first on Cyber Security News.

May 16, 2025 - 05:46

Windows Defender Application Control Bypassed Using Operationalizing Browser Exploits

Researchers have uncovered a sophisticated technique to bypass Windows Defender Application Control (WDAC), a critical Windows security feature designed to prevent unauthorized code execution.

The bypass leverages vulnerabilities in trusted Electron applications, effectively circumventing one of Microsoft’s most robust security mechanisms aimed at high-assurance environments.

By exploiting the underlying V8 JavaScript engine used in these applications, attackers can execute malicious code even under the strictest WDAC policies.

WDAC functions as an application whitelisting mechanism, enforcing policies that only allow explicitly trusted executables, scripts, and drivers to run on a system.

It’s particularly valuable in environments where system integrity is paramount, making this discovery especially concerning for organizations relying on WDAC as a core security control.

The bypass demonstrates how trusted applications can become vehicles for attack when they contain exploitable vulnerabilities.

IBM analysts from the X-Force team identified the novel approach, which they’ve dubbed “bring your own vulnerable application.”

According to lead researcher Valentina Palmiotti, the technique involves targeting signed, trusted Electron applications that contain vulnerabilities in their implementation of the V8 JavaScript engine.

Since these applications are already whitelisted in WDAC policies, they provide an ideal vector for executing arbitrary code.

The research revealed that even when an organization implements the most stringent WDAC configurations, these can be circumvented by exploiting vulnerabilities in trusted applications.

What makes this attack particularly stealthy is that the execution occurs within the context of a browser-like process, where behaviors that might otherwise trigger endpoint detection and response (EDR) systems appear normal, such as having RWX (read-write-execute) memory mapped for Just-In-Time compilation.

Exploit Mechanism: Argument Smuggling and JIT Optimization Challenges

The bypass technique employs what researchers termed “argument smuggling” to execute malicious code.

Operationalized Exploit Execution Flow (Source – IBM)

This method involves overwriting specific fields in JavaScript function objects to store crucial information needed by the payload.

By manipulating these objects, attackers can pass arguments to shellcode without traditional parameter passing mechanisms.

// Example of how argument smuggling works within the exploit
// Overwriting unused fields in the JSFunction object to store payload information
function smuggleArguments(jsFunc, payloadAddress, payloadSize) {
    // Store crucial information in unused object fields
    write64(jsFunc + OFFSET_PAYLOAD_ADDRESS, payloadAddress);
    write64(jsFunc + OFFSET_PAYLOAD_SIZE, payloadSize);
}

The researchers encountered significant challenges with TurboFan’s JIT optimization, which would deduplicate identical floating-point values in memory.

This imposed limitations on shellcode smuggling, requiring careful crafting of unique values to prevent optimization.

To overcome inconsistent offsets across different Windows versions, they developed a “Just-in-time exploit engine” that would try multiple possible offsets until successful execution was achieved.

While Electron has introduced an experimental integrity verification feature that could prevent such attacks in newer versions, many popular applications have yet to implement this protection.

This leaves numerous environments vulnerable to this sophisticated WDAC bypass technique, highlighting the ongoing cat-and-mouse game between security mechanisms and innovative exploitation methods.

How SOC Teams Save Time and Effort with ANY.RUN - Live webinar for SOC teams and managers

The post Windows Defender Application Control Bypassed Using Operationalizing Browser Exploits appeared first on Cyber Security News.