Edge 122.0.2365.63 – pulled due to serious issues – fix with Edge 122.0.2365.66

[German]Microsoft has released another update of the Edge (Chromium) browser with version 122.0.2365.63 in the stable channel on 29 February 2024. It is a maintenance update that is supposed to fix problems, but has already been withdrawn from the WSUS and is buggy. Addendum: Edge 122.0.2365.66 fixes the problem – explanations added in the article.

Fixes a vulnerability

A German blog reader pointed out the update in this comment (thanks for that). The (security) release notes state that the latest Chromium fixes are included (see Google Chrome 122.0.6261.94/.95) and that the vulnerability CVE-2024-26196 has been fixed.

There is a bug

But it seems to have been another quick fix by the specialists from Redmond. At 7:21 am today, 1 March 2023, the same user reported that Edge 122.0.2365.63 had just been withdrawn from the WSUS (thanks for the tip).

In addition, the user referred to the German forum post Microsoft Edge 122.0.2365.63 _ Arbeitsspeicher voll !!! at deskmodder.de, where Andi already addresses the problem. As soon as he updates the Microsoft Edge browser to version 122.0.2365.63, nothing works anymore. The message appears on every website: Not enough memory to open this page. Guest access or new profiles should work.

A workaround

A German user reported in my blog, that the option "Improve your security on the web" must be completely deactivated in Edge, then it will work again! Alternatively use a GPO: "Improve the security status in Microsoft Edge" and enable the default mode, to fix the issue. What a mess.

Edge 122.0.2365.66 fixes the bug

Addendum 2: With Edge 122.0.2365.66, a bug fix update was released on March 1, 2024.

Fixing the Defender Application Guard bug

The statement in the release notes regarding the fixes is rather interesting. In addition to the obligatory "Fixed various bugs and performance issues." (how many times does Microsoft want to tell us this?) there is an interesting piece of information:

Resolved a network issue that prevented sites from loading within a Microsoft Defender Application Guard window.

In other words, the Microsoft Defender Application Guard, which is actually responsible for security, caused the problem. The above workaround by disabling the "Improve your web security" option disabled the WDAG in Edge and it worked again.

Edge Defender Application Guard deprecated

And this rings a bell in the back of my head: Microsoft's developers announced some time ago that they were discontinuing this stuff. I mentioned it in December 2023 in the blog post Microsoft declares Windows "Mixed Reality" – and also Defender Application Guard for Edge as deprecated. The Microsoft support document Microsoft Edge support for Microsoft Defender Application Guard contains the passage on January 24, 2024:

Important

Microsoft Defender Application Guard, including the Windows Isolated App Launcher APIs, will be deprecated for Microsoft Edge for Business and will no longer be updated.

Existing installations of Application Guard

This deprecation does not impact the existing installations of Microsoft Defender Application Guard (MDAG). Organizations can continue to use Application Guard on current versions of Windows, but we recommend that security admins evaluate their security requirements going forward. This feature might be removed in a future Windows release, but it will continue to be maintained for existing installations on Windows.

Deprecation considerations

Deprecation includes the following elements of Application Guard. […]

My conclusion (I don't use the Edge browser): It's yet another fail from "first class software" from Redmond in the tradition of "users, cope with our crap, we've lost track".