Suspicious Edge WebView2 Execution

Duo Tech@duotech

•updated Jun 2, 2026•0•0•6

Detects the execution of Microsoft Edge WebView2 (msedgewebview2.exe) with flags indicating an embedded browser instance and a custom user data directory pointing to the AppData\Roaming folder. This behavior is commonly leveraged by malware masquerading as simple utilities, such as the Calendaromatic malware (CL-CRI-1089), to interact with the host operating system and hide malicious activities within webview processes.