EUVD-2026-52532
GHSA-xj82-8xpc-8x9g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Network-accessible browser flaw requiring user interaction; no attacker authentication; limited low-integrity tampering and low confidentiality exposure with no availability or scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.
AnalysisAI
Origin validation error in Microsoft Edge (Chromium-based) allows network-positioned unauthenticated attackers to perform cross-origin tampering when a victim user interacts with malicious web content. The flaw (CWE-346) undermines the browser's origin enforcement logic, enabling integrity and confidentiality compromise at low severity per CVSS 5.4. Tagged as an Authentication Bypass vector, suggesting edge cases where origin-gated auth flows in Edge may be bypassed. No active exploitation confirmed (not in CISA KEV), no public POC identified, and a vendor patch is available via MSRC.
Technical ContextAI
Microsoft Edge (Chromium-based) is a browser built atop the Chromium engine, widely deployed in enterprise Windows environments. The affected CPE - cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:* - covers all versioned releases of the Chromium-based Edge variant. CWE-346 (Origin Validation Error) describes a failure to properly verify that an incoming request or resource originates from the expected domain or security context. In browser implementations, this class of flaw can subvert the Same-Origin Policy (SOP), allowing content from one origin to influence or access resources from another. The 'Authentication Bypass' tag in the intelligence data indicates this particular origin confusion may be exploitable to bypass authentication checks in web applications rendered within Edge, beyond generic cross-origin data leakage.
RemediationAI
Apply the vendor-released patch by updating Microsoft Edge to the latest available version. Users can trigger an update by navigating to edge://settings/help within the browser, which automatically checks for and installs the newest release. The authoritative patch advisory is published by Microsoft at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66317 - consult this directly for the confirmed fixed build number, as no specific version number is independently confirmed in the available intelligence data. For organizations unable to patch immediately, compensating controls include restricting Edge usage to explicitly allowlisted trusted domains via enterprise Group Policy (using the URLBlocklist policy), disabling access to untrusted or external web content in high-sensitivity environments, and enforcing network egress filtering to prevent browser sessions from reaching attacker-controlled origins. Note that URL blocking may impact legitimate web workflows and should be scoped carefully. Given the low CVSS severity, absence of KEV listing, and availability of an official fix (RL:O), patching via the standard browser update cycle is the recommended primary action.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Use-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execu
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today