Microsoft testing ‘Super Duper Secure Mode’ for its Edge browser

Source: Daniel Rubino / Windows Central

Microsoft is testing out a “Super Duper Secure Mode” on its Edge browser. The goal of the mode is to improve browser security without adversely affecting performance. Super Duper Secure Mode is only an experiment at the moment and will likely get a new name that’s “more professional” when it launches.

The Microsoft Browser Vulnerability Research team breaks down the experimental feature in more technical detail (via Bleeping Computer). For everyday users, the main takeaway is that Microsoft is working on a way to make its Edge browser more secure without lowering its performance.

At the core of the experiment is the “Just-In-Time-Compilation” (JIT) engine. This technology can help speed up web browsing but comes at the cost of security.

“Performance and complexity often come at a cost, and often we bear this cost in the form of security bugs and subsequent patches,” explains Microsoft. “Looking at CVE (Common Vulnerabilities and Exposures) data after 2019 shows that roughly 45% of CVEs issued for V8 were related to the JIT engine.”

Source: Microsoft
Disabling JIT reduces the vulnerability potential of the browser. Microsoft says that this can “remove roughly half of the V8 bugs that must be fixed.”

As part of its experiment, Microsoft performed hundreds of performance tests with JIT enabled and disabled. “Anecdotally, we find that users with JIT disabled rarely notice a difference in their daily browsing,” explains Microsoft.

Testing does show variance in performance, but how much those changes affect everyday browsing is yet to be seen. Microsoft also notes that the value of performance gains brought by JIT depends on what people are doing on the web. For example, someone reading a blog might not mind a minor drop in performance compared to someone gaming online.

Microsoft plans to experiment with its Super Duper Secure Mode over the next few months. You can try it out by enabling its flag through edge://flags in Edge Canary, Dev, and Beta.