EUVD-2026-41648
GHSA-8xhm-6cw5-pfjj
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 07, 2026
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticated attacker circumvent a browser security control over the network via improper authorization (CWE-285). Microsoft rates it CVSS 10.0 with a changed scope, meaning a successful bypass can affect resources beyond the browser's original security boundary. There is no public exploit identified at time of analysis, and CISA's SSVC framework records exploitation as 'none', so this is a high-severity but not currently-exploited issue with a vendor patch already available.
Earlier versions of this analysis (2)
Security feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticated attacker circumvent a browser security control over the network, per CVSS a scope-changing high-confidentiality/high-integrity impact (CVSS 10.0). Microsoft reported the flaw and has shipped a fixed build; no public exploit identified at time of analysis, and EPSS remains low at 0.46% (37th percentile). CISA SSVC currently rates exploitation as 'none' with total technical impact but non-automatable exploitation.
Security feature bypass in Microsoft Edge (Chromium-based) lets a remote unauthenticated attacker circumvent a browser-enforced authorization control over the network, per CWE-285 improper authorization. Microsoft rates it CVSS 8.7 with a scope-changed impact (C:H/I:H), meaning a successful bypass reaches resources or a security boundary beyond the vulnerable component. No public exploit identified at time of analysis (temporal E:U), and Microsoft has already shipped an official fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Microsoft Edge Chromium Based gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Network-reachable unauthenticated bypass with cross-boundary (S:C) high C/I impact and no availability effect, but UI:R since a browser victim realistically must load attacker content.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
Executive ViewAI
Microsoft Edge versions below 150.0.4078.48 contain a critical authorization bypass (CVE-2026-57983, CVSS 10.0) that allows unauthenticated remote attackers to circumvent browser security controls and compromise resources beyond the browser environment. While no public exploit has been identified at time of analysis, the maximum severity rating and broad attack surface present substantial organizational risk. A vendor patch is immediately available and should be deployed urgently to all endpoints.
Within 24 hours: Inventory all Microsoft Edge installations and identify systems running versions prior to 150.0.4078.48. Within 7 days: Deploy Microsoft Edge version 150.0.4078.48 or later to all affected endpoints. Within 30 days: Verify patch deployment completion across all systems and confirm no pre-150.0.4078.48 versions remain in production.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote code execution in Microsoft Edge (Chromium-based) lets an attacker run arbitrary code in the browser by getting a
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Use-after-free memory corruption in Microsoft Edge (Chromium-based) can let remote attackers execute arbitrary code in t
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Exploit-DB