Modern web browsers rely heavily on Just-In-Time (JIT) compilation to execute JavaScript at near-native speeds. However, according to cybersecurity research from Microsoft and security teams worldwide, memory corruption vulnerabilities within the V8 JavaScript JIT engine account for more than half of all exploited browser zero-days. To protect users against sophisticated web-based memory attacks, Microsoft Edge includes Enhanced Security Mode (historically developed under the code-name Super Duper Secure Mode).
This tutorial explains how to enable and configure Enhanced Security Mode in Microsoft Edge, choose between Balanced and Strict protection tiers, apply Hardware-enforced Stack Protection, and manage site exceptions for critical business web apps.
How Enhanced Security Mode Protects Your Browser
When Enhanced Security Mode is enabled on a website, Microsoft Edge enforces strict hardware and engine defenses:
- Disables JIT Compilation: By eliminating dynamic JIT compilation on unfamiliar websites, entire classes of memory corruption and type-confusion exploits are rendered impossible to execute.
- Enforces Hardware-Enforced Stack Protection: On supported Intel (CET) and AMD (Shadow Stack) processors, Edge uses silicon-level return address checking to neutralize Return-Oriented Programming (ROP) attacks.
- Applies Arbitrary Code Guard (ACG): Prevents dynamic code generation in memory threads, ensuring processes cannot load untrusted executable payloads.
Enabling Enhanced Security Mode in Edge Settings
Enhanced Security Mode is integrated directly into the privacy architecture of modern Microsoft Edge releases on Windows, macOS, and Linux.
- Open Microsoft Edge on your PC or Mac.
- Click the three horizontal dots (…) in the top-right corner and select Settings.
- In the left sidebar, click Privacy, search, and services.
- Scroll down to the Security section.
- Locate the toggle titled Enhance your security on the web (or Enhanced security mode) and switch it to On.
Choosing Between Balanced and Strict Security Tiers
Once toggled on, Microsoft Edge offers two distinct operational levels tailored to different threat profiles:
| Protection Level | Targeted Websites | User Experience Impact |
|---|---|---|
| Balanced (Recommended) | Applies JIT disabling only on unfamiliar, infrequently visited websites. | Websites you visit regularly retain high-speed JIT performance; unfamiliar links run under strict isolation. |
| Strict | Enforces enhanced mitigations across all websites universally. | Maximum theoretical security. Some complex web applications or interactive games may load slightly slower. |
Performance Reality Check
While disabling JIT reduces synthetic JavaScript benchmarks, real-world browsing performance for reading news, reviewing documentation, streaming media, and submitting cloud forms is virtually indistinguishable to the human eye, with page loads differing by mere milliseconds.
Managing Exceptions for Trusted Web Applications
If an internal enterprise tool, banking dashboard, or browser-based CAD tool requires JIT compilation to function correctly, add it to your exceptions list.
- Under the Enhance your security on the web section in Edge Settings, click Exceptions.
- Click the Add a site button.
- Enter the URL pattern of your trusted domain (for example,
https://intranet.company.comor[*.]figma.com). - Click Add. Microsoft Edge will permit full JIT performance on this specific domain while continuing to enforce strict mitigations across the rest of the web.
Inspecting Enhanced Security Status on Active Web Pages
You can check whether Enhanced Security Mode is actively protecting your current browsing session:
- Navigate to any website in Microsoft Edge.
- Click the View site information (padlock or tune) icon on the far left of the address bar.
- If active, a security badge displays reading: “Enhanced security is active for this site.”
- You can use the in-popup toggle to quickly turn protection off for that specific domain if a page breaks, without diving into global settings.
Troubleshooting Website Incompatibilities
If web pages fail to execute interactive scripts or display blank widgets after enabling Enhanced Security Mode:
- Complex WebAssembly (Wasm) Apps: Heavy WebAssembly applications (such as in-browser video editors) rely on JIT translation. If a Wasm module throws runtime memory exceptions, add the domain to your Exceptions whitelist.
- Corporate Group Policy Overrides: In enterprise environments, IT administrators can enforce Enhanced Security Mode using the
EnhanceSecurityModepolicy via Microsoft Intune or Active Directory GPO. If settings appear locked with an organisation icon, review your enterprise security baselines.