EUVD-2026-112939
GHSA-rf35-49cw-94j3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to malicious web page
-
ExploitDeliver crafted web content to Edge
-
ExecutionTrigger integer overflow (CWE-190)
-
ImpactElevate privileges on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use the Chromium-based Microsoft Edge and to interact with attacker-controlled web content - the CVSS UI:R metric confirms user interaction (e.g., navigating to a malicious page) is mandatory, which is the primary limiting factor. No authentication is required (PR:N) and the vector is network-reachable (AV:N) against the browser as deployed; no special non-default configuration is called out in the available sources. The precise feature, parser, or web content required to trigger the integer overflow is not described in the available sources, so the trigger cannot be narrowed further than attacker-supplied web content processed by Edge. |
| Impact | The input CVSS of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a serious, network-reachable, unauthenticated flaw whose only brake is required user interaction (UI:R) - consistent with a browser bug triggered by navigating to attacker-controlled web content. However, the temporal metrics in the same vector materially lower real-world urgency: E:U (Exploit Code Maturity: Unproven) means no exploit is known, RL:O confirms an Official Fix is available, and RC:C marks the report as Confirmed. There is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or probable exploitation; the only reference is the vendor patch page. The vuln.today Decision label is 'this_week', which aligns with a patch-available, high-severity, not-yet-exploited issue - a real priority to remediate promptly, but not an emergency. One labeling tension to verify: the description says 'elevate privileges over a network' yet the CVSS models scope as unchanged (S:U) with full C/I/A impact and PR:N - Microsoft routinely classifies Chromium browser memory-safety bugs as network-vector EoP, but the exact privilege boundary crossed is not detailed in the available sources. |
| Exploit ScenarioDerived | An attacker hosts or injects crafted web content that triggers an integer overflow (CWE-190) in the Chromium-based Microsoft Edge; when a victim navigates to the malicious page (UI:R), the overflow corrupts memory in a way that lets the attacker elevate privileges on the host. No public exploit is identified at time of analysis and exploit maturity is Unproven (E:U). The specific trigger within Edge is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
An integer overflow / wraparound flaw (CWE-190) in Microsoft Edge (Chromium-based) can be turned into privilege elevation: a remote, unauthenticated attacker who gets a victim to load attacker-controlled web content can, per the CVSS vector, achieve high confidentiality, integrity and availability impact within the browser's security context. Exploitation is gated by user interaction (UI:R), which the independent assessment identifies as the primary limiting factor, and no special non-default configuration is called out; the exact parser or feature that must be reached to trigger the overflow is not described in the available sources. No public exploit code or KEV entry is identified at time of analysis, and Microsoft has published a vendor fix via the MSRC update guide, so this is prioritised for routine remediation this week rather than emergency response.
RemediationAI
Vendor-released patch: Microsoft has published a fix, with patch availability confirmed from the vendor and the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88077 serving as the authoritative reference for the specific Edge build numbers per release channel; apply that update through Edge's standard update mechanism or your enterprise software-deployment tooling and restart the browser so the new build is active, and confirm installed versions against the MSRC page since the exact fixed build string is not enumerated in the available data. The priority decision for this CVE is 'this_week', so schedule the update within the current patch cycle rather than treating it as an emergency. No workarounds or compensating controls are described in the available sources, and because exploitation only requires the victim to load attacker-controlled web content (UI:R), there is no documented configuration change that removes the exposure while keeping affected browsing functionality - the browser update is the fix. No public exploit code has been identified at time of analysis, which supports a scheduled rather than out-of-band rollout.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Microsoft Edge is built on the Chromium engine, so a defect classified under CWE-190 (Integer Overflow or Wraparound) is a memory-safety issue in code that processes attacker-influenced input, where arithmetic on a size, length or index value can wrap and produce an undersized allocation or an out-of-bounds access. The supplied tags list both 'Integer Overflow' and 'Buffer Overflow' alongside Google and Microsoft, which is consistent with this being a Chromium-lineage issue propagated into the Edge release; the specific component, parser or web API involved is not stated in the available sources, and the evidence does not describe how the wraparound is reached, so the trigger cannot be narrowed beyond attacker-supplied web content processed by the browser. The CPE record (cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*) is fully wildcarded on version, meaning the product family - not a specific release branch - is the affected scope identified by this intelligence. Per the independent assessment, the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H means the flaw is network-reachable and requires no authentication, but demands user interaction for success; note that CVSS metrics describe severity, not mechanism, and scope is unchanged (S:U), so the privilege gain is relative to the browser's own trust boundary rather than a full system compromise as vectorised. Temporal metrics E:U/RL:O/RC:C indicate no confirmed exploit at scoring time.
Know when Microsoft Edge Chromium Based gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Browser flaw triggered by attacker web content: network vector, no auth (PR:N), but user must open the content (UI:R); full C/I/A impact per vendor classification of this EoP.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
Executive ViewAI
A high-severity privilege elevation vulnerability in Microsoft Edge can be triggered when a user visits malicious web content, potentially allowing an attacker to gain the same rights as the browser user. While no active exploitation has been observed, the broad deployment of Edge across the organization means a successful attack could lead to data exposure or system compromise for any affected employee, making timely patching a priority to maintain endpoint security.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote code execution in Microsoft Edge (Chromium-based) before 150.0.4078.48 allows an unauthenticated attacker to run
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) lets an attacker run arbitrary code in the browser by getting a
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Security feature bypass in Microsoft Edge (Chromium-based) lets unauthenticated remote attackers evade an incomplete inp
Type confusion (CWE-843) in Microsoft Edge (Chromium-based) allows an unauthenticated remote attacker to execute arbitra
Memory-safety flaw in Microsoft Edge (Chromium-based) that can lead to remote code execution. All builds from 1.0.0.0 th
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Use-after-free memory corruption in Microsoft Edge (Chromium-based) can let remote attackers execute arbitrary code in t
Heap-based buffer overflow in Microsoft Edge (Chromium-based) can lead to remote code execution when a user opens or ren
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows remote attackers to execute code in the browser whe
Exploit-DB