The latest version of Microsoft’s Edge browser records and sends the URL of almost every website that users visit to a Bing API website, according to multiple independent analyses. This leak appears to be linked to Edge’s new “follow creator” feature.
Redditor hackermchackface, who first reported the flaw, told VPNOverview that he “discovered the behavior by accident while searching proxy traffic for something unrelated.” At least one developer, contacted by The Verge, has also confirmed that the leak is due to Edge’s “poorly implemented” follow creator feature.
Microsoft gradually rolled out this feature in January 2022 via its Edge Canary browser builds. It is designed to allow users to receive the latest updates from their favorite content creators or websites. For example, if you’re watching a video on YouTube, you’ll find the “Follow this creator” button on the Edge address bar. If you click the button, you’ll be able to browse through new videos from the creator in your Edge Collections — without logging into YouTube.
Initially, users could only follow creators on platforms like YouTube and TikTok. However, the company later extended the feature to allow users to add news websites and other platforms.
To disable this feature on Edge, go to Settings > Privacy > Search > Services. You should see “Show Suggestions to follow creators in the Microsoft Edge section.” Toggle it off. Alternatively, you can switch to a more privacy-friendly browser.
Unintended Tracking
The bug appears to only affect Edge versions 112.0.1722.34 and later. Microsoft said it is currently investigating the issue. At the time of writing, no patch had been issued to fix the leak. We’ve reached out to Microsoft for comment.
Redditor hackermchackface said he was “alarmed” after discovering the leak and suspected it was the result of a bug.
“My initial thoughts were that the intended function of this feature was probably not to track users’ web activity, as it lacked the tracking metadata that would normally be seen,” he said.
According to the Redditor, the browser relays almost every website users visit to bingapis.com via a GET request.
“It doesn’t matter if it’s a local domain or even an IP address, the full URL of every site you follow from then on is passed to Bing. This includes any links, logins, etc, clicked or otherwise navigated to, not just URLs typed or copied into the navigation bar, as is the well-known behavior of other privacy-invading browser features,” he wrote.
Software engineer Rafael Rivera told The Verge that Edge’s follow creator feature is designed to notify Bing when users visit particular pages. However, it isn’t working correctly and sends every domain a user visits to a Bing API domain.
Leak Could be ‘Catastrophic’
While the data that Edge is collecting hasn’t been leaked, there’s always a possibility that threat actors can gain access to it. The effects of such a leak would be “catastrophic,” hackermchackface said.
To protect your privacy, we recommend disabling the follow creator feature on Edge until Microsoft releases a patch to fix it.
“I think this incident will result in significant data breaches for businesses, and warrants a formal statement from Microsoft of how they will ensure this data is purged, especially as there was no warning of risk from this option provided to commercial customers,” hackermchackface said.
Your browsing data can reveal much about your interests and personality, and various parties may be harvesting this data without your knowledge. Our guide to protecting your browsing history contains useful information about how to access the web privately.
