I didn't see this mentioned in the blog posts but I believe Edge also has win32k filtering[1] to reduce the kernel attack surface as well (added in the AU). This is different from the win32k lockdown that Chrome uses which completely blocks all win32k syscalls but instead allows a whitelist(?) for acceptable syscalls to help reduce the attack surface (I'm not actually sure how it works).
It seems the signature is checked before allowing this mitigation so only Microsoft signed applications can currently use this mitigation[1].
It seems the signature is checked before allowing this mitigation so only Microsoft signed applications can currently use this mitigation[1].
[1] https://googleprojectzero.blogspot.com/2016/11/breaking-chai... (see Wrap Up section near the end)