EUVD-2026-42401
GHSA-465q-rjv4-qq7x
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Network-delivered browser flaw needing victim interaction (UI:R) but no privileges (PR:N); bypass crosses a security boundary (S:C) and mainly discloses sensitive data (C:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
AnalysisAI
Security feature bypass in Microsoft Edge (Chromium-based) allows a remote, unauthenticated attacker to circumvent a browser security control over the network when a user is lured into interacting with attacker-controlled content. The scope-changing CVSS 8.2 vector and high confidentiality impact suggest the bypass can expose sensitive information beyond the browser's normal security boundary. Reported by Microsoft's own security team; no public exploit identified at time of analysis.
Technical ContextAI
The affected component is Microsoft Edge built on the open-source Chromium engine, meaning the flaw may share root causes with upstream Chromium code even though it is tracked under Microsoft's advisory. The weakness is classified as CWE-284 (Improper Access Control), a broad class where the software fails to correctly restrict which actors can perform an action or reach a resource. In a browser context this typically manifests as a same-origin, sandbox, or security-UI/policy control that can be evaded, letting web content reach data or capabilities it should not. The scope change (S:C) in the CVSS vector indicates the impact crosses a security boundary - for example, content in one security context affecting another.
RemediationAI
Apply the latest Microsoft Edge security update as published in the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58525); Edge updates automatically, so ensure the browser is allowed to update and restart it to apply the fix - the exact fixed build should be taken from that advisory as no specific patch version was provided in the input data. As a compensating control until the update is confirmed deployed, restrict browsing to trusted sites and avoid interacting with untrusted links, since exploitation requires user interaction; enterprises can enforce this via SmartScreen/Defender web filtering and by managing update channels through Group Policy or Intune to guarantee timely rollout. There is no indication that disabling a single feature mitigates this without vendor guidance, so patching remains the primary and recommended fix.
More in Edge Chromium
View allChrome's V8 JavaScript engine contains an out-of-bounds read and write vulnerability (CVE-2025-5419, CVSS 8.8) enabling
Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the r
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remo
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to
Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially
Heap buffer overflow in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit he
Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially expl
Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability. Rated high severity (CVSS 8.2), this vulnerability is r
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability
A security vulnerability in No cwe for this (CVSS 7.4) that allows an unauthorized attacker. Risk factors: public PoC av
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today