EUVD-2026-83446
GHSA-h9w4-646p-4c73
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privileged code execution
-
DeliveryTrigger use-after-free in Edge engine
-
ExploitReclaim freed object with controlled data
-
ExecutionExecute code across scope boundary
-
ImpactElevate privileges on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access with an existing low-privileged foothold on a Windows host running Microsoft Edge (Chromium-based) at a version below 153.0.4234.46 (PR:L, AV:L, UI:N). Exploitation is further limited by AC:H: the use-after-free is timing/race-dependent, so it is not reliably or automatically triggerable (SSVC Automatable=no). No remote or unauthenticated path exists; the attacker must already be able to execute in the local context. Applying the vendor update to 153.0.4234.46 or later removes the condition. |
| Impact | This is a genuine but moderate-priority local privilege-escalation flaw, not a remotely-wormable emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H = 7.8 HIGH) confirms local access with existing low privileges is required and that exploitation is complicated (AC:H - typical of use-after-free race/timing conditions), but that successful exploitation crosses a scope boundary (S:C) with total confidentiality, integrity, and availability impact. Multiple signals point AWAY from urgency: EPSS is only 0.22% (13th percentile), CISA SSVC records Exploitation=none and Automatable=no, and there is no KEV listing and no public POC - so exploitation status is 'no public exploit identified at time of analysis.' The one signal pointing toward severity is SSVC Technical Impact=total, which is consistent with the full C:H/I:H/A:H and the sandbox/scope escape implied by S:C. Net: a patched, non-automatable, low-EPSS local EoP in a browser - real and worth patching in normal cycles, but not a high-CVSS-but-inflated issue nor a drop-everything item. No major conflicts between sources; the description ('elevate privileges locally') aligns cleanly with AV:L and PR:L. |
| Exploit ScenarioDerived | A local, low-privileged attacker who can already run code on the host (or lure an authenticated user to run a crafted page/local payload) triggers the use-after-free in Edge's Chromium engine, reclaiming the freed object to gain control and elevate privileges across a security boundary (S:C) to a higher-privileged context. Because AC:H reflects a race/timing-dependent UAF, reliable exploitation is non-trivial. No public exploit code is identified, and neither KEV nor SSVC indicate active or automatable exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 24, 2026
Local privilege escalation in Microsoft Edge (Chromium-based) versions below 153.0.4234.46 stems from a use-after-free (CWE-416) memory corruption flaw that an attacker with an existing low-privileged foothold on a Windows host can trigger to elevate privileges. Exploitation requires local access and low privileges (AV:L, PR:L, UI:N) and is constrained by high attack complexity (AC:H) because the bug is timing/race-dependent, so it is not reliably or automatically triggerable (SSVC Automatable=no); the changed-scope rating (S:C) reflects impact that can cross a security boundary such as the browser sandbox. No public exploit code has been identified and EPSS is low at 0.22% (13th percentile), with no evidence of active exploitation in CISA KEV or SSVC (Exploitation=none), making this a genuine but moderate-priority patching item rather than a remotely wormable emergency.
Earlier versions of this analysis (1)
Local privilege escalation in Microsoft Edge (Chromium-based) allows an attacker who already holds a low-privilege foothold on a Windows host to abuse a use-after-free memory corruption flaw and cross a security boundary into a higher-privileged context. The vendor scores this 8.1 (High) on the strength of the scope change (S:C) and high confidentiality, integrity, and availability impact, but the assessed vector is AV:L/AC:H with PR:L, meaning the attack is not network-reachable, requires an existing local foothold, and depends on winning a race condition plus a favorable heap layout; this materially lowers real-world urgency compared with a remotely exploitable browser RCE. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but a vendor patch is available from Microsoft, so applying the current Edge update removes the flaw.
RemediationAI
Vendor-released patch: update Microsoft Edge (Chromium-based) to version 153.0.4234.46 or later, applied through the standard Microsoft Edge stable-channel update mechanism or the MSRC guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88097; verify the deployed version via edge://version after updating. Because the flaw requires a pre-existing local low-privileged foothold and high-complexity timing manipulation, the most effective compensating control is to eliminate that foothold: enforce least-privilege on endpoints, restrict interactive logon and code execution for non-administrative users, and tighten application allowlisting, with the trade-off that these controls raise operational friction for legitimate local tooling but do not block the underlying memory bug. Where immediate patching is not feasible, reducing the attack surface by disabling unnecessary browser features and extensions and limiting local multi-user access lowers exposure, though none of these is a complete substitute for the 153.0.4234.46 update since the use-after-free remains reachable in the unpatched build. Monitor for a future Chromium upstream fix reference, as Microsoft Edge inherits Chromium security fixes and the MSRC advisory is the authoritative source for the corrected build.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in Microsoft Edge's Chromium-based browser engine, a memory-safety class in which a heap object is freed but a dangling pointer to it is subsequently dereferenced, allowing an attacker to influence reuse of the freed memory and potentially achieve code execution in the context of a more privileged process. Because the vulnerable component runs with a different security scope than the impacted component (CVSS S:C), successful exploitation can cross a privilege boundary - consistent with the browser's multi-process architecture, where a compromised renderer or utility process may be leveraged against the broker/browser process. The affected CPE string cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:* confirms the Chromium-based Edge channel as the sole identified product family, and EUVD cross-references this as EUVD-2026-83446 with the fix boundary at 153.0.4234.46. The high attack complexity (AC:H) aligns with race-condition/timing-dependent memory reuse, meaning reliable exploitation demands precise heap grooming rather than a deterministic trigger.
Know when Microsoft Edge Chromium Based gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Local UAF EoP by an already-present low-privileged attacker (AV:L/PR:L); race-dependent trigger (AC:H); sandbox/privilege boundary escape (S:C) yielding total impact (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.
Executive ViewAI
A high-severity local privilege escalation flaw in Microsoft Edge on Windows endpoints could let someone who already holds a low-privileged foothold on a machine escalate to higher rights, potentially crossing the browser's sandbox boundary and reaching data or system functions they should not access. Because it requires an attacker to already be running on the host and is difficult to trigger reliably due to timing conditions, it is not a remotely exploitable or self-propagating threat, but it is a meaningful post-compromise escalation path on any workstation where a user, contractor, or malware has limited access. Leadership should treat this as a routine but time-bound patch obligation affecting the Edge browser footprint across the Windows estate, with remediation effort and risk both concentrated on endpoints rather than servers or internet-facing systems.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) lets an attacker run arbitrary code in the browser by getting a
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Use-after-free memory corruption in Microsoft Edge (Chromium-based) can let remote attackers execute arbitrary code in t
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Exploit-DB