Key points:

• 
  Security flaw in Microsoft Edge browser (CVE-2024-21388) allowed attackers to install arbitrary extensions without user consent.
• Exploitation required running JavaScript on specific Microsoft-owned websites like bing.com or microsoft.com.
• Attackers could abuse the edgeMarketingPagePrivate API to install extensions from the Edge Add-ons store.
• Insufficient validation in the API allowed for the installation of any extension identifier without user interaction.
• The bug could lead to privilege escalation and browser sandbox escape.
• Microsoft released a patch in Edge version 121.0.2277.83 in January 2024, crediting the researchers who reported the issue.
• No evidence of exploitation in the wild was found, but the vulnerability underscores the potential for complex attacks via seemingly harmless extensions.

Takeaways to avoid such issues:

• 
  Regularly update browsers to the latest versions to patch security vulnerabilities.
• Encourage responsible disclosure of security flaws to vendors for timely fixes.
• Employ strict validation measures in browser APIs to prevent unauthorised access and installation of extensions.
• Educate users about the risks of installing unfamiliar extensions and encourage caution.
• Implement browser security features such as sandboxing to mitigate the impact of potential exploits.