Attn, windows 10 Cortana users - Here is one good reason why you should be applying the latest MS patches. (Microsoft has fixed this ) A locked PC with Cortana enabled on the lock screen allows an attacker with physical access to the device to launch two kinds of unauthorized exploits simply by querying her, researchers at McAfee said Tuesday.

Attn, windows 10 Cortana users - Here is one good reason why you should be applying the latest MS patches.  (Microsoft has fixed this ) A locked PC with Cortana enabled on the lock screen allows an attacker with physical access to the device to launch two kinds of unauthorized exploits simply by querying her, researchers at McAfee said Tuesday.

In the first case, the attacker can force Microsoft Edge to navigate to an attacker-controlled URL; in the second, the attacker can use a limited version of Internet Explorer 11 using the saved credentials of the victim,” the researchers said in a post.

In the first scenario, a Cortana privilege escalation leads to forced navigation for Microsoft Edge on a lock screen. Essentially, the flaw does not allow an attacker to unlock the device, but it does allow someone with physical access to ask Cortana to use Edge to navigate to a page of the attacker’s choosing, while the device is still locked.
“It is surprising that links are offered and clickable
when the device is locked,” researchers said. “If you start your favorite network sniffer or man-in-the-middle proxy, you will see that the links are visited as soon as the user clicks on them, irrespective of the device’s locked status.”


https://threatpost.com/microsoft-cortana-flaw-allows-web-browsing-on-locked-pcs/136558/