diff --git a/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp b/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp index 920d2c72d4fa..d212c686d9e7 100644 --- a/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp +++ b/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp @@ -299,6 +299,19 @@ Result SandboxBroker::LaunchApp( "Setting the reduced set of flags should always succeed"); } + // Bug 1936749: MpDetours.dll injection is incompatible with ACG. + constexpr sandbox::MitigationFlags kDynamicCodeFlags = + sandbox::MITIGATION_DYNAMIC_CODE_DISABLE | + sandbox::MITIGATION_DYNAMIC_CODE_DISABLE_WITH_OPT_OUT; + sandbox::MitigationFlags delayedMitigations = + mPolicy->GetDelayedProcessMitigations(); + if ((delayedMitigations & kDynamicCodeFlags) && + ::GetModuleHandleW(L"MpDetours.dll")) { + delayedMitigations &= ~kDynamicCodeFlags; + SANDBOX_SUCCEED_OR_CRASH( + mPolicy->SetDelayedProcessMitigations(delayedMitigations)); + } + // If logging enabled, set up the policy. if (aEnableLogging) { ApplyLoggingPolicy();