Microsoft Edge: Import Google account data anytime from Settings

🚨 The Signal: Microsoft Edge now allows users to import Google account data (passwords, bookmarks, history, autofill) at any time from settings, not just during initial setup. This increases the risk of sensitive data exfiltration or accidental exposure.

The Impact

End users are affected by increased risk of sensitive data exposure and exfiltration.

• End users: Risk of exposing personal credentials and browsing history to corporate devices.
• Security teams: Increased risk of sensitive data exfiltration from corporate endpoints.
• Compliance teams: Potential non-compliance with data handling policies and regulatory requirements.

The Action

1. Review and update Microsoft Edge Group Policies or Intune profiles to restrict data import capabilities.
2. Communicate updated acceptable use policies to end-users regarding personal data on corporate devices.
3. Monitor endpoint activity for unusual data import or browser data access patterns.
4. Consider implementing Data Loss Prevention (DLP) policies to detect and prevent sensitive data exfiltration via browsers.

Domain: M365-Apps · Impact: high · Workload: M365 Apps · Essential Eight: User Application Hardening · ISM: ISM-1412, ISM-1485, ISM-1486, ISM-1542, ISM-1585, ISM-1667, ISM-1668, ISM-1669, ISM-1670, ISM-1823, ISM-1824, ISM-1859, ISM-1860