EUVD-2026-29690
GHSA-4j3q-g7jx-6rw4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Remote attacker needs no privileges but requires victim interaction (UI:R); scope change (S:C) reflects cross-boundary disclosure with high confidentiality and no integrity/availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Information disclosure in Microsoft Edge (Chromium-based) before 148.0.3967.55 allows a remote, unauthenticated attacker to read data they should not have access to by luring a victim into interacting with malicious web content. Rooted in external control of a file name or path (CWE-73) with a changed CVSS scope, it can leak sensitive information across security boundaries. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.05%).
Technical ContextAI
The flaw is in Microsoft Edge, Microsoft's Chromium-based web browser (CPE cpe:2.3:a:microsoft:microsoft_edge_(chromium-based)). CWE-73 (External Control of File Name or Path) means a resource identifier used by the browser can be influenced by attacker-controlled input, causing the browser to reference or load a resource the attacker chooses rather than one the user intended. Combined with the CVSS scope change (S:C), the disclosure crosses a trust/security boundary - for example leaking data from a different origin or a local resource into an attacker-controlled context. Because Edge ships on Windows and tracks the broader Chromium codebase, the reference to Google in the tags reflects that shared upstream lineage.
RemediationAI
Vendor-released patch: 148.0.3967.55 - update Microsoft Edge to 148.0.3967.55 or later via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41107. Ensure Edge automatic updates are enabled and fully relaunch the browser to apply the fix, since Chromium-based Edge only completes updates on restart; in managed environments push the update through your standard software distribution or update-channel policy. As an interim compensating control before patching, discourage users from following untrusted links and reduce exposure to attacker-controlled web content, though this relies on user behavior and does not eliminate the risk.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Use-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execu
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today