Microsoft’s Windows Recall still allows silent data extraction
Summary
Microsoft's Windows Recall feature remains vulnerable to data theft even after a security rebuild, because malware running with normal user permissions can extract captured screenshots and text without needing special access or breaking encryption. The vulnerability exists because decrypted data is processed in an unprotected part of the system where user-level code can reach it, despite Microsoft's claims that the redesigned architecture would prevent this type of attack.
Solution / Mitigation
According to the researcher, a short-term fix would be for Microsoft to add stronger code integrity and process protections to AIXHost.exe (the process that displays the Recall timeline), which currently has none. A longer-term solution would require Microsoft to either render data inside a protected process or use a compositing model where unencrypted data never leaves the secure enclave (a trusted area where sensitive operations happen).
Classification
Original source: https://www.csoonline.com/article/4159643/microsofts-windows-recall-still-allows-silent-data-extraction.html
First tracked: April 16, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 95%