Cortana persona with icons from different web browsers

Open links force-opened in Microsoft Edge in your default browser

Microsoft really wants Windows 10 users to chooselove their new Microsoft Edge web browser. Users don’t even need to choose it as their default browser, because seemingly normal web links all over Windows 10 and the Cortana digital assistant all force-open in Microsoft Edge rather than in your system defined default web browser of choice. Comtraya!

EdgeDeflector is my tiny new helper program that says “that isn’t cool!” to Windows, and lets you use your default web browser anyway.

I don’t hate Microsoft Edge — maybe you do! — but I do believe users who have bothered to configure a different default web browser should be allowed to keep using that default web browser. Edge is a portal for Microsoft to push its own features and services, and to collect personal data about people’s browsing habits. It’s understandable that Microsoft wants to push their own web browser, but this is not the way to do it.

EdgeDeflector puts the user back in control of their default browser setting. Download EdgeDeflector from GitHub releases, and please do read the installation instructions.

How indeed do you want to open this web link?

How does it work and what does it do?

There is no complicated logic or magic to how EdgeDeflector works. Cortana and some of the core apps for Windows 10 use a special URI protocol to mask normal URIs and have them open in Microsoft Edge. Instead of the regular https://example.com/ link, Microsoft apps and services uses its own microsoft-edge:https://example.com/ link schema. As no other browser recognize this protocol and the protocol isn’t configured by the default web browser setting, Microsoft Edge is left as the only program that can open the link even when there are other browsers installed on the system.

EdgeDeflector registers itself as a program capable of opening these special microsoft-edge URIs. When you click one one of these links after installing EdgeDeflector, Windows will ask you how you want to open the link. By choosing EdgeDeflector, EdgeDeflector will rewrite the link to become a regular web link and pass it back to Windows. Windows will then open the link with your default web browser — whether that is Firefox, Chrome, Vivaldi, something else, or indeed Microsoft Edge.

Standards and URIs

You can’t change the default web browser away from Safari on iOS. To get around this, Google Chrome and pretty much every other web browser started adding their own browser vendor URI prefixes that worked the same way as the microsoft-edge URI on Windows 10. This allowed other app vendors and other apps by the browser vendor to open links in their browser of choice. It’s a neat little work around for something that wouldn’t ever have been an issue if Apple had allowed a greater level of customization on iOS.

The special vendor URIs on iOS and now Windows 10 are all about vendor lock-in. As a user, your choices for what software you want to run are limited by corporate interests that conflict with your own ability to choose your own preferred web browser. This is unhealthy for the mobile web as a whole, and it’s an unhealthy and undesirable development on desktop operating systems.

I don’t believe the other browser vendors should register and attempt to hijack this vendor specific browser schema by default. Although it’s technically possible, as evidenced by the existence of EdgeDeflector, this would only instigate an undesirable war with Windows where ultimately even more lockdown is the most probable end result.

If you agree with me and want Windows to stop forcing the use of Microsoft Edge and rather have it respect your choice of default browser, please let Microsoft know in the Windows Feedback Hub (requires Windows 10).


Microsoft Edge has two and a half custom URI protocols in addition to the standard http and https. These are the mostly undesirable microsoft-edge and the as of yet unused microsoft-edge-holographic, plus the read schema. It’s unclear what microsoft-edge-holographic is supposed to do; as of now it creates an infinite loop of opening tabs in Windows preview builds.

The read protocol for Edge’s reading view, e.g. read:https://ctrl.blog/entry/edgedeflector-default-browser, is more interesting but I’ve already covered it in a separate article. I personally believe that the read URI is quite a good innovation and would love to see other web browsers implement this URI schema. Firefox, Safari, and Vivaldi all have their own reading views with their own URIs – and they’re all terrible in comparison with Edge’s neat little read: links.

Wait— doesn’t this program of yours already exist?

Only after completing the programming on EdgeDeflector as a weekend project, did I discover that there already was a program that tries to do the exact same trick as EdgeDeflector. (I was using Bing for search that week, go figure.) SearchWithMyBrowser seems to be quite popular based on the number of articles written about it. However, after quickly reading through the code I discovered serious problems such as a arbitrary code execution vulnerabilities (e.g. microsoft-edge:calc.exe would open the Calculator app rather than a browser) and unwittingly executing invalid commands on the system level for some of the microsoft-edge URIs that are found in Windows.

I’d already thought of and addressed these problems to the best of my ability in EdgeDeflector. I’ve contacted the author of SearchWithMyBrowser to let him know about the problems. Another of these programs has received quite a lot of media attention in the tech press in the past, so there should be quite a few vulnerable systems out there. Ouch.

Update : SearchWithMyBrowser has since been updated to version 1.0.0 which patches most attack vectors for the vulnerability mentioned above. This version also introduces usability improvements like a binary distribution package.

Note on responsible disclosure of security vulnerabilities: I had problems getting in touch with the developer privately, and ended up posting about the vulnerability on the public bug tracker for lack of a private communication channel. As SearchWithMyBrowser doesn’t have auto-update nor any way to notify users of new versions, the vulnerability will probably remain unpatched for the majority of users for the lifetime of their Windows installation whether an updated version of the software had been made available or not.

Sources

  • AppxManifest.xml, from Microsoft Edge version 15.15031
  • SearchWithMyBrowser issue #18, , Daniel Aleksandersen, SearchWithMyBrowser project on GitHub

10 comments

  1. Interesting. But what about a .reg file that points to a certain browser?

    I’ve found the key HKEY_CLASSES_ROOTmicrosoft-edge but I don’t know how to edit it or if there’s something more to edit. Thanks in advance 🙂

    1. No other browser support the microsoft-edge URI schema, so they wouldn’t know what to do with it. EdgeDeflector receives the microsoft-edge URI and rewrites it to a standard http[s] URI which other browsers can receive and interpret. You can’t achieve the schema-rewriting with just registry entries. Have a look at the source code (referenced above) for details on how it works.

  2. This got me so mad that I downloaded Fedora. Thats that Linux you keep talking about right? Im gonna give Windows a break for a few weeks. See how Linux fairs now days. It has been years since I tried using it last.

    1. Fedora is indeed my preferred distribution. Though, give Ubuntu a shot for a week if Fedora isn’t your cup of tea! I hope you’ll stay with Linux. Thanks for reading and for your comments!

  3. This is weird thing and not expected from Microsoft, they are leader in market but there is different between a good leader and a good navigator. Forcing users to use a browser that they do not prefer to use is worst marketing skill. We all know Microsoft did this before with Netscape.

  4. First of all: thanks a million!

    Now if only there were a way to make the search open in Chrome in a new window and not a new tab of the current window; you can see how this greatly diminishes its functionality with Chrome. Though from what I’ve researched and tested, it seems there’s nothing Edge Deflector can really do about this as Chrome apparently doesn’t have a way to open links from external apps in anything but a new tab.

    Or am I wrong in assuming there’s no clever hocus-pocus that Edge Deflector can do to force the desired behavior?

    1. Have you considered using a web browser that behaves the way you like? There are many more options available than just Google Chrome.

      As for your question: In Program.cs, change line 135 to the path to chrome.exe. Add a new line underneath it saying exactly: Arguments = “–new-window ” + url,. Compile.

      You’ve just made EdgeToNewChromeWindowDefelctor. It’s not something I’m interested in making, but you do have the option.

      You could also change the URLAssociation in the SystemRegistry so that Chrome will always opeh HTTP and HTTPS protocol links with the –new-window argument.

      1. Thank you for breaking two solutions down for me so succinctly…it’s a huge help since I’m just a demanding, borderline-OCD technology user and not a developer.

        As for your first point…bit of a stretch to imply that my perfect browser is out there just waiting for me to discover it. I’ve used and keep up with FF and derivatives, Vivaldi, Opera, and lesser known ones as well over the years. Chrome can be aggravating and inflexible, but it has the extensions I can’t live without and generally does what I want it to. Until Vivaldi can actually run all my Chrome extensions properly, Chrome is still the best for me, imperfect though it is.

        Again, thanks for the response and the solution(s) to my problem. 🙂

  5. Hi, Great little application. I was just wondering if you know of any simple solution to change what search provider is used?

    The url from the windows search is (https://www.bing.com/search?q=hello&form=WNSGPH&qs=SW&cvid=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=hello&cc=AU&setlang=en-US&nclid=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx)

    The only information required is the search query, being “hello” in this case I’d imagine? So it could be transformed into (https://www.google.com.au/#q=hello) easily enough? Or have I missed something completely.

Leave a Reply

Your email address will not be published. Be courteous and on-topic. Comments are moderated prior to publication.