EUVD-2026-52526
GHSA-338p-cq77-8m7h
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
TOCTOU race conditions require precise timing to win the race window, warranting AC:H; UI:R and PR:N confirmed by CVSS data; no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Time-of-check time-of-use (toctou) race condition in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Microsoft Edge (Chromium-based) is affected by a Time-of-Check Time-of-Use (TOCTOU) race condition that allows a remote, unauthenticated attacker to disclose sensitive information over the network, contingent on user interaction. The flaw exploits the timing gap between a security check and subsequent resource use within the Chromium-based browser engine, potentially exposing cross-origin data or internal browser state. No active exploitation has been confirmed by CISA KEV, and the temporal CVSS metrics (E:U) confirm no proven exploit code exists at time of analysis; a vendor patch is available via MSRC.
Technical ContextAI
The vulnerability is classified as CWE-367 (Use of Race Condition), specifically a TOCTOU flaw in which a program validates a condition and then acts on a resource, but an attacker manipulates the resource state during the intervening window before use. In the context of a Chromium-based browser, this race window may arise in browser security checks governing cross-origin resource access, memory state validation, or renderer-process communication. The affected product per CPE is cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:* - the wildcard indicates all versions are implicated, without a bounded range confirmed in the provided data. Because Edge inherits the Chromium/Blink rendering pipeline, the root cause may reside in shared upstream Chromium code, though Microsoft's MSRC is the disclosing entity and the authoritative source for scope and patch details.
RemediationAI
Vendor-released patch is available per Microsoft's Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66314; users and administrators should apply the patched version of Microsoft Edge (Chromium-based) identified there, as an exact fix version number was not included in the provided intelligence data and must be confirmed from the MSRC advisory directly. As a compensating control prior to patching, enterprise administrators can enforce URL allowlisting through web proxy or Microsoft Edge group policy (e.g., URLBlocklist/URLAllowlist policies) to restrict navigation to untrusted or unknown domains, which reduces the attack surface by making the required user-interaction step harder to trigger; the trade-off is reduced general browsing capability. Managed environments should also ensure Microsoft Edge is enrolled in automatic update policies to minimize the window between patch release and deployment.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Remote code execution in Microsoft Edge (Chromium-based) before 150.0.4078.48 allows an unauthenticated attacker to run
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today