Researchers Break Into Windows' Most Protected Memory Area via SmartScreen Component, Microsoft Has Already Patched It

Researchers at the security firm Doyensec have shown they can run their own code inside a part of Windows designed to stay sealed off even if the rest of the computer is compromised. The area is called a VBS enclave, an isolated slice of memory the operating system uses to guard secrets. The one they broke into supports Enhanced Phishing Protection in Microsoft Defender SmartScreen, which warns users if they type their Windows password into an unsafe place such as Notepad or a phishing page.

The flaw is tracked as CVE-2026-83498. Microsoft rates it Critical, with a CVSS score of 7.8, and classes it as an elevation-of-privilege issue. The work was done in a lab as a proof of concept. Microsoft says the issue has not been exploited and was not publicly known before the fix, and that it also found the same problem internally. The patch arrived in the September 8, 2026 update, and Doyensec published its research on October 13.

There is an important limit on the risk. The attack does not work from a distance. It needs a program already running on the machine that loads and calls the enclave, and Microsoft says the attacker needs low-level access but no help from the user. In short, it lets code that already has a foothold reach into a more trusted area, rather than offering a way in from outside.