Researcher Demonstrates DLL Sideloading Through Microsoft Edge WebView2

Summary

Matthew Eidelberg demonstrates how writable WebView2 DLL dependencies can enable code execution in Windows apps. He says Microsoft reclassified the issue and had no plans to fix it at the time of its last communication.

Key points

The demonstrated technique requires write access to a user-writable application data path containing a WebView2 dependency.
A replacement DLL can run attacker-supplied code while forwarding functions to the renamed legitimate DLL, preserving application behavior.
Eidelberg demonstrated the technique with Microsoft Teams and Outlook and said the WebView2 issue does not itself provide privilege escalation.
The researcher said Microsoft initially confirmed the behavior but later reclassified its impact and did not plan a fix at the time of its last communication.
Face Dancer generates proxy DLLs for sideloading tests but does not provide payload evasion by itself.
Defenders can investigate unusual DLL downloads and application data files, including unexpected signatures, recent compilation times and hashes that differ across machines.

Article Details

Topics: [01:31] DLL hijacking and sideloading prerequisites
[07:17] Windows app security and containerization
[11:46] WebView2 dependencies and writable DLL paths
[20:02] Proxy DLL and shellcode demonstrations
[22:38] Face Dancer capabilities and limitations
[30:38] Microsoft disclosure and reported remediation status
[36:30] Detection guidance for suspicious DLLs
[43:42] Delivery methods and defensive testing
[51:14] User-context execution and privilege escalation limitations