Microsoft Edge for Mac now supports 'Super Duper Secure Mode'

Microsoft is working on a Super Duper Secure Mode for their Edge browser which disables the Just In Time javascript interpreter in Edge, which the Microsoft Browser Vulnerability Research Team feels is responsible for a large number of browser vulnerabilities.

The feature started on Windows, but is now available on Edge Canary for macOS.  Its arrival was announced by Johnathan Norman, Microsoft Edge Vulnerability Research Lead.

We updated Super Duper Secure Mode. The feature is now supported on Mac. Windows users will now have ACG enabled as well. You can find these changes in Edge Canary (94.0.992.0+) . This update also changes the behavior to allow some sites/processes to run without SDSM

— Johnathan Norman (@spoofyroot) August 24, 2021

The news was also accompanied by a somewhat worrying change in Super Duper Secure Mode.  Microsoft has addressed issues where SDSM breaks some sites by automatically disabling it on those sites, which includes places like Facebook, which seems to somewhat counter-productive. Microsoft is however working on a way for users to control the feature and where it is available.

The Super Duper Secure Mode in Edge disables the JIT and enables new security mitigations. These include enabling the new Controlflow Enforcement Technology (CET) in Edge render process and in the future adding support for Web Assembly, Arbitrary Code Guard (ACG), and other new security mitigations.

Microsoft hopes Super Duper Secure Mode will be  ”something that changes the modern exploit landscape and significantly raises the cost of exploitation for attackers”.

You can find Edge Canary for macOS here.