EUVD-2026-41568
GHSA-vgq6-3mhg-7562
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered browser flaw requires user interaction; confidentiality rated high for meaningful sensitive data exposure; no integrity or availability impact indicated.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 expose sensitive information to unauthorized network actors, enabling spoofing attacks against users who interact with attacker-controlled content. The vulnerability maps to CWE-200, indicating that browser-internal sensitive data (likely origin, URL, or session context) is improperly disclosed across a network boundary, allowing an attacker to impersonate trusted content or identities. No public exploit code or CISA KEV listing exists at time of analysis; however, the CVSS score of 6.5 with a network attack vector and no privilege requirement underscores meaningful real-world risk for any unpatched Edge deployment.
Technical ContextAI
Microsoft Edge (Chromium-based) is built on the open-source Chromium browser engine and shares its rendering and security architecture with Google Chrome. The affected CPE string (cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:*) covers all builds from 1.0.0.0 up to the patched release. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause as a failure in access control or isolation logic within the browser, where data that should be scoped to a specific origin or session becomes observable by an external actor. In a Chromium-based browser context, such flaws frequently involve cross-origin information leakage - e.g., through navigation APIs, referrer headers, document.domain behavior, or frame inspection - that exposes details enabling spoofing of URLs, identities, or security indicators. The 'spoofing over a network' characterization suggests the disclosed data is leveraged to deceive a user about the source or integrity of browser-rendered content.
RemediationAI
Upgrade Microsoft Edge (Chromium-based) to version 150.0.4078.48 or later, which contains the vendor-released patch per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56646. Edge typically auto-updates in consumer and managed enterprise environments; administrators should verify update compliance via Microsoft Endpoint Manager or Intune by checking the installed Edge build version. If immediate patching is not feasible, consider restricting user navigation to untrusted external content via enterprise browser policies (e.g., enforcing SmartScreen, disabling navigation to unknown URLs through Edge management policies), though these controls are partial mitigations and carry the trade-off of reduced user browsing flexibility. No confirmed workaround that fully eliminates the information disclosure pathway has been published.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Remote code execution in Microsoft Edge (Chromium-based) before 150.0.4078.48 allows an unauthenticated attacker to run
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today