What is the CVSS score of CVE-2026-66311?

CVE-2026-66311 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-66311?

Yes, a patch is available for CVE-2026-66311. Update the affected software to the latest version immediately.

Microsoft Edge CVE-2026-66311

EUVD-2026-52531 MEDIUM

Missing Authorization (CWE-862)

2026-08-03 microsoft

GHSA-78rr-mxgh-pv8f

Authentication Bypass Google Microsoft Microsoft Edge Chromium Based

6.2

CVSS 3.1 · Vendor: microsoft

Temporal: 5.4

Severity by source

Vendor (microsoft) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CIRCL (temporal)

5.4 MEDIUM

cvss

vuln.today AI

6.2 MEDIUM

Local-only vector confirmed; PR:N reflects no privilege requirement per description; C:H retained pending vendor clarification of the tampering-vs-confidentiality discrepancy.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 00:12 vuln.today

CVE Published

Aug 03, 2026 - 22:57 cve.org

MEDIUM 6.2

DescriptionCVE.org

Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.

AnalysisAI

Missing authorization controls in Microsoft Edge (Chromium-based) allow a local attacker without any system privileges to bypass authorization and perform tampering actions against the browser. The flaw (CWE-862) results in high confidentiality impact per the CVSS vector, though the description characterizes the effect as tampering - a discrepancy addressed in confidence notes below. No public exploit code has been identified and Microsoft has released an official patch through the MSRC advisory portal.

Technical ContextAI

Microsoft Edge (Chromium-based) is built on the open-source Chromium engine and is affected here at the application layer per CPE cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:*. CWE-862 (Missing Authorization) identifies the root cause as an absence of access control checks on a locally accessible operation or API within Edge, rather than a bypass of authentication credentials. This class of flaw typically arises when browser internals - such as privileged extension APIs, inter-process communication channels, or internal browser pages - are accessible without verifying that the caller holds the required authorization level. The Chromium foundation introduces a complex multi-process architecture (browser process, renderer process, GPU process) where IPC boundaries must enforce authorization; a missing check at any boundary can expose restricted functionality to unprivileged local code or users.

RemediationAI

Apply the vendor-released patch available through the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66311. Microsoft Edge updates automatically on most managed and consumer deployments; administrators should confirm that auto-update is not blocked by group policy and verify the installed Edge version against the fixed version published in the MSRC advisory (exact fixed version not confirmed in available data - check the advisory directly). For environments where patching cannot occur immediately, consider restricting local user access to shared systems running Edge, enforcing least-privilege user accounts, and auditing local access controls on systems where Edge stores sensitive browser data. Disabling unnecessary Edge extensions or privileged internal browser pages may reduce the attack surface but carries usability trade-offs and does not constitute a definitive fix.