EUVD-2026-41596
GHSA-443f-8vj4-c2c4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered XSS with no authentication, low complexity, but requires user interaction; limited confidentiality and integrity impact, no availability impact, and no scope change beyond the browser session.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft Edge (Chromium-based) prior to version 150.0.4078.48 enables network-based spoofing attacks against users who interact with attacker-controlled content. The flaw stems from improper input neutralization during web page generation (CWE-79), allowing injected scripts to execute within the browser's context and manipulate rendered content. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released a patch addressing the issue.
Technical ContextAI
CWE-79 (Improper Neutralization of Special Elements used in an Output Used by a Downstream Component - 'Cross-site Scripting') is the root cause, indicating that user-supplied or externally-sourced input is not adequately sanitized before being reflected or stored in a web page rendered by Edge. Microsoft Edge (Chromium-based) inherits Chromium's rendering engine (Blink) and V8 JavaScript engine, meaning the XSS surface likely involves either Edge-specific browser UI components, extension handling, or Edge's proprietary features layered on top of Chromium. The CPE string (cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:*) confirms all Chromium-based Edge versions from 1.0.0.0 up to (but not including) 150.0.4078.48 are affected. The spoofing impact suggests the XSS may allow manipulation of browser UI elements (e.g., the address bar or security indicators) rather than purely content-level script injection.
RemediationAI
Update Microsoft Edge (Chromium-based) to version 150.0.4078.48 or later, as confirmed by the vendor patch available via the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58524. Edge typically auto-updates when allowed by enterprise policy; administrators should verify managed environments have not blocked automatic updates. As a compensating control where immediate patching is not possible, consider enforcing strict Content Security Policy (CSP) headers on internal web applications to limit XSS propagation, and restrict Edge's access to sensitive internal sites through network segmentation - though neither eliminates the underlying browser flaw. Disabling JavaScript globally via group policy would prevent XSS execution but would render most modern web applications non-functional and is not a practical enterprise workaround.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Remote code execution in Microsoft Edge (Chromium-based) before 150.0.4078.48 allows an unauthenticated attacker to run
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today