Microsoft announces “Super Duper Secure Mode” for its Edge desktop browser, which disables V8's JIT, allowing for security features like Arbitrary Code Guard
Microsoft said today it plans to run an experiment in its Edge web browser where it will intentionally disable …
Context & Ripple Effects
Edge was built with a security posture that excluded legacy browser components, including ActiveX, VB Script and browser helper objects. Microsoft later moved Edge to Chromium while committing to invest in that engine, so the new experiment tests how far its hardening can go within the Chromium-based browser.
The experiment extends Edge’s safety-oriented product work beyond a Kids Mode with strict tracking prevention: rather than changing defaults for a user segment, it alters a core code-execution path to make protections such as Arbitrary Code Guard available.
First-order effects
- Microsoft can test a desktop Edge configuration that disables V8’s just-in-time compiler and supports Arbitrary Code Guard, prioritizing exploit resistance in that mode.
- Edge desktop users participating in the experiment face a more restrictive browser execution model than the standard JIT-enabled configuration.
Second-order effects
- Microsoft’s Edge team must assess whether the security benefit justifies the compatibility and performance trade-offs inherent in removing JIT compilation before broadening the mode.
- The move puts browser hardening emphasis on execution architecture rather than only privacy and content controls, extending the direction set by Edge’s earlier removal of legacy extensibility components.
Third-order effects
- If JIT-free modes prove usable, browser security may increasingly segment into selectable execution profiles that trade some performance for stronger platform-enforced protections.
- The longer-term competitive distinction for Chromium-based browsers may depend less on the shared rendering engine and more on vendors’ willingness to maintain differentiated security configurations.
The trend: Browsers are moving from removing legacy attack surfaces toward optional, deeper execution-layer defenses within shared browser engines.