A First Look at Chromium-Based Edge

I've been excited about Edge moving to Chromium for a while and yesterday the public dev version of Edge was released! I downloaded it from https://www.microsoftedgeinsider.com/en-us/ and was very curious to see how it compared (forensically) to Chrome.

Short version: it looks a lot like Chrome and it should be easy to parse.

Testing Edge Dev on Windows

I ran Edge through my normal testing process for a new Chrome version (installing it in a VM and running a consistent set of "user" actions). It looked remarkable similar to Chrome (no surprise there) but with the Google-related stuff stripped out; the settings pages start with edge:// instead of chrome://, Bing is used by default instead of Google, and the account for signing into the browser is a Microsoft one rather than Google. I'm sure there are many more subtle differences that I didn't see in my quick pass, but if you use it you are sure to get a sense of déjà vu. Microsoft says it has changed or removed quite a few features beyond the three I mentioned:

Despite these changes, behind the scenes the underlying browser data looks remarkable similar to Chrome. I processed the Edge profile like I did for the Chrome Evolution comparison, and it looks very, very similar (again, not a surprise for a Chromium-based browser). It uses SQLite databases, LevelDB, JSON, Chromium Cache files, and even SNSS for the Current Session/Tabs files:

Hindsight also parses it just fine, at least at a quick pass (I'll do more verification later):

Update 2019-05-07: Edge for macOS

It appears that Microsoft will release a version of their new Chromium-based Edge browser for Mac! This isn't really surprising, since Chromium is cross-platform already, but it has been a while since there was a Microsoft-made browser that ran on macOS.

I downloaded the dev build and did some test browsing, similar to the process outlined above. I wanted to see how this Edge variant looked from an artifacts perspective.

I ran Hindsight against the Edge profile (located in ~/Library/Application Support/Microsoft Edge Dev/Default) and it mostly worked. The one variation I noticed was the Cookies SQLite database had a few slightly different fields:

• firstpartyonly is absent and samesite was added; I suspect this is a replacement but I'm not positive. This change is likely due to Edge Dev being based on Chrome 76, which makes privacy changes around cookies. More info on SameSite here.
• added is_edgelegacycookie - likely related to migrations/upgrades.

I say "mostly worked" because the absence of the firstpartyonly column caused Hindsight to decide that it didn't match any known versions of Chrome (I mean, which is right) and crash (which is not right). I've pushed a small update to make sure Hindsight won't crash in this situation anymore - and it now parses Edge on macOS just fine!

Future

That's it for the quick first look! I'll definitely be looking closer at Edge as it progresses towards a stable release, and look for Hindsight to parse more browsers in the future!