Microsoft Edge Now Automatically Blocks Malicious Browser Notifications Used in Scareware Attacks

Microsoft Edge now automatically turns off website notifications linked to detected scams, cutting off a persistent delivery channel for fake antivirus warnings and deceptive security alerts. Introduced with Edge 156 in October, the protection links Microsoft Defender SmartScreen and Scareware blocker detections to the website sending the notification.

Microsoft detailed the capability in its November 2 technical announcement, authored by Rob Franco and Lu Huang. The change addresses a recurring weakness in browser notification permissions: one misleading approval can let attackers repeatedly lure users back to fraudulent pages, even after the original website closes.

Microsoft Edge Blocks Malicious Notifications

Attackers persuade visitors to enable notifications through deceptive instructions, including claims that clicking “Allow” proves they are not robots. Once permission is granted, malicious websites can deliver alarming messages impersonating security warnings. Selecting those notifications sends users to scareware pages designed to manufacture urgency and fear.

This persistent access model has appeared in campaigns involving AI-generated content and malicious push notifications, where deceptive publishing funnels users into recurring notification subscriptions. The browser permission itself becomes a reusable route back to potential victims.

Microsoft identified the connection while reviewing reports submitted through Scareware blocker. Many detected scam pages originated from website notifications, revealing that blocking individual destinations did not necessarily eliminate the source of repeated exposure.

With the updated behavior, a scam detected by either SmartScreen or Scareware blocker triggers automatic notification disabling when Edge associates that scam with a notification sender. The intervention targets the originating website’s notification access rather than merely interrupting the current scam page.

On the next browser startup, Edge displays an information bar explaining the action. Users can inspect blocked websites in Edge Settings and restore notifications if they believe the decision was incorrect. This preserves a recovery path for false positives.

The approach complements wider browser defenses, including Chrome’s controls against abusive notifications and AI-based detection of fake antivirus websites. However, Edge’s announced mechanism specifically links a detected scam destination to enforcing notification permissions.

Edge now includes a reporting option for notification permission requests. Users can click the menu next to “Block” and choose “Block and report” to submit the requesting URL along with a screenshot of the misleading page. These reports can help SmartScreen gather evidence before it receives abusive notifications.

Microsoft states that the Scareware blocker directly protects tens of thousands of users daily, and the intelligence shared through SmartScreen provides additional protection to millions more. Users can also manually turn off unwanted notifications by using the three-dot menu on the notification, which helps them avoid deceptive alert buttons that might lead to additional scam windows.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.