EUVD-2026-41645
GHSA-vr8w-r9rr-cvrq
Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Local-only access (AV:L), race condition demands precise timing (AC:H), low-privilege authorized attacker; scope change for cross-boundary disclosure; no integrity or availability impact per disclosure-only description.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
1DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to disclose information locally.
AnalysisAI
Race condition in Microsoft Edge (Chromium-based) permits a locally authenticated, low-privileged attacker to disclose information beyond the intended security boundary, with the CVSS scope change (S:C) indicating impact can extend outside the directly vulnerable component - potentially across process or sandbox boundaries within the browser. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, placing it in a lower operational priority tier despite the scope change. Microsoft has released a patch via the MSRC advisory.
Technical ContextAI
CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) describes a class of flaw where two or more threads or processes access a shared resource without adequate locking, creating a window in which an attacker can manipulate state between a check and its use. Microsoft Edge is Chromium-based (as indicated by CPE cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:* and the 'Google' tag referencing shared Chromium lineage), meaning the vulnerable shared resource likely resides in the multi-process browser architecture - renderer, browser, or GPU processes - where concurrent operations on shared memory, handles, or file descriptors are common. The CVSS metrics AV:L/AC:H reflect that the race window must be triggered locally and requires precise timing, consistent with classic time-of-check to time-of-use (TOCTOU) exploitation patterns. The S:C (scope change) metric signals the disclosed information originates from a component outside the attacker's direct control, such as a privileged browser process or a sandboxed renderer accessing data it should not expose to the local user session.
RemediationAI
Apply the vendor-released patch by updating Microsoft Edge to the latest available version via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55945. The exact patched build number is not specified in the available intelligence and should be confirmed from the MSRC page directly. For environments where immediate patching is constrained, the most targeted compensating control is to restrict local interactive access to Edge on sensitive systems, since exploitation requires AV:L - preventing unauthorized local sessions eliminates the attack surface entirely. Restricting which local users can run Edge (via AppLocker or Windows Defender Application Control policies) reduces exposure, though it may impact legitimate browser workflows. No workarounds for the underlying race condition are available without the patch.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Use-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execu
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today