Microsoft Bug Bounty Program News Today : Breaking News, Live Updates & Top Stories | Vimarsana

Chaining a misconfiguration in IE11/Edge Legacy with an argument injection in a Windows 10/11 default URI handler and a bypass for a previous Electron patch, we developed a drive-by RCE exploit for Windows 10. The main vulnerability in the ms-officecmd URI handler has not been patched yet and can also be triggered through other browsers (requires confirmation of an inconspicuous dialog) and desktop applications that allow URI opening.

Microsoft has been accused of slashing bug bounty reward money by large amounts by several security researchers. One of them said his finding was worth just 10% compared to the earlier value.