Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave
Researchers bypass Windows SmartScreen enclave security to run code.
Run Windows SmartScreen?
Get an email when a reviewed story names Windows SmartScreen, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Security researchers have successfully executed their own code within the Windows SmartScreen VBS enclave, a protected memory area designed to safeguard sensitive information. This enclave is crucial for protecting passwords and is part of Windows' anti-phishing capabilities. The researchers demonstrated this capability in a lab setting as a proof of concept, highlighting a significant security flaw.
The lesson from this incident
Full lessonA four-byte memory write vulnerability combined with a timing bug allowed security researchers to execute arbitrary code inside the Windows SmartScreen Virtualization-Based Security (VBS) enclave — a protected region specifically designed to isolate sensitive credentials and anti-phishing logic. This is significant because VBS enclaves are considered a hardened trust boundary; breaching one undermines a core security assumption of Windows' defense-in-depth architecture. Attackers who replicate this technique in the wild could potentially extract protected passwords or disable phishing protections silently. The lab-based proof of concept demonstrates that even hardware-assisted isolation is not immune to software-level logic flaws. Organizations relying on Windows Credential Guard and SmartScreen as compensating controls must treat this as an urgent patching priority.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.