Edgecution: Malicious Edge Extension Escapes Browser Sandbox via Native Messaging

Browser Extension Used as a Ransomware Delivery Vehicle

Researchers have documented a novel attack chain in which a malicious Microsoft Edge browser extension was used to escape the browser sandbox and deploy a Python-based backdoor on the victim's system — ultimately facilitating a ransomware infection. The extension, internally named "Edgecution" by researchers, demonstrates that browser extensions can serve as a meaningful initial access or lateral movement vector when attackers can get one installed in a target environment.

The Attack Chain: From Extension to Ransomware

The attack flow exploits the Native Messaging API, a legitimate browser feature that allows browser extensions to communicate with native applications installed on the host operating system. This is the same API used by legitimate tools like password managers and video downloaders to interact with desktop software outside the browser sandbox.

In the Edgecution attack:

1. Extension Installation: The malicious extension was installed in the victim's Edge browser — likely through social engineering, a compromised enterprise policy, or by abusing developer mode.
2. Native Messaging Bridge: Once active, the extension used the Native Messaging API to communicate with a native host process on the victim's machine. Native hosts run outside the browser sandbox with the full privileges of the logged-in user.
3. Python Backdoor Deployment: The native host component received instructions from the extension and executed a Python-based backdoor, establishing a persistent foothold on the host system.
4. Ransomware Delivery: With a stable backdoor in place, attackers used the access to deploy ransomware, encrypting files on the compromised endpoint.

Why Native Messaging?

The Native Messaging API was designed for legitimate integration between browser extensions and desktop software. However, it has long been recognized as a potential security boundary weakening mechanism — an extension can effectively reach outside the browser sandbox entirely, so long as a registered native host application is present on the system.

What makes this attack vector particularly interesting:

• Sandbox escape without exploiting a bug: Unlike traditional browser exploits, this attack doesn't require a vulnerability in the browser engine itself. It uses a designed communication channel.
• Legitimate-looking traffic: Native Messaging communication is harder to detect than typical C2 traffic because it uses standard OS inter-process communication.
• Enterprise exposure: Organizations that deploy browser extensions via Group Policy or MDM are especially at risk if a malicious extension enters the approved catalog.

Extension vs. Exploit: A Different Threat Model

Most browser security discussions focus on web content vulnerabilities (XSS, CSRF, renderer exploits). Edgecution highlights a different threat model: malicious extensions as delivery vehicles. Extensions receive elevated trust compared to web pages — they can access browser storage, intercept requests, and use privileged APIs like Native Messaging.

This matters because:

• Enterprise environments often whitelist or auto-deploy extensions via policy
• Extension review processes (even in the Edge Add-ons store) are imperfect
• Once an extension is installed, users typically grant it ongoing implicit trust

Indicators and Detection

Security teams investigating potential Edgecution-style attacks should look for:

• Unexpected native host registrations: Check HKCU\Software\Google\Chrome\NativeMessagingHosts (and Edge equivalents) for unrecognized native messaging host entries.
• Python processes spawned by browser processes: A Python process with a browser (msedge.exe) parent is highly anomalous.
• Unusual extension installations: Audit installed browser extensions against approved lists, particularly in enterprise environments.
• EDR telemetry: Look for Edge child processes launching interpreters (python.exe, powershell.exe, cmd.exe).

Recommendations

1. Audit browser extensions across your environment. Enforce an approved extension allow-list via Group Policy or Intune.
2. Restrict Native Messaging — if your organization doesn't use any software that requires Native Messaging, consider blocking it at the policy level.
3. Monitor for interpreter processes launched by browser processes using EDR tooling.
4. Disable developer mode extensions in managed environments to prevent unpublished extension sideloading.
5. User awareness: Train users to be skeptical of prompts asking them to install browser extensions, particularly from unfamiliar websites.

The Edgecution campaign is a reminder that the browser, while sandboxed, is not isolated — and that extensions represent a legitimate API surface that attackers are willing to abuse when it enables them to reach the host OS without exploiting a CVE.