thehackernews.com
Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave
Security researchers demonstrated that a four‑byte write and timing flaw in Windows’ VBS enclave allowed them to execute code inside the protected memory area used by Microsoft Defender SmartScreen’s Enhanced Phishing Protection. The proof‑of‑concept attack, published by Doyensec on October 13, 2026, exploited a local vulnerability in SFAPE.dll, enabling code execution within the enclave without reading passwords. Microsoft patched the issue in the September 8, 2026 cumulative update (KB5124008) and rated it Critical (CVE‑2026‑83498). The flaw highlighted a weakness in [...]