EUVD-2026-52533
GHSA-f74h-78gx-6g84
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Network-delivered browser flaw requiring user visit (UI:R); no authentication needed; high confidentiality from cross-origin data read; low integrity from spoofing; no availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
Origin validation error in Microsoft Edge (Chromium-based) enables a remote unauthenticated attacker to perform cross-origin spoofing attacks, achieving high confidentiality impact and limited integrity impact against victims who interact with attacker-controlled content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) with temporal indicators E:U/RL:O/RC:C indicates an officially patched vulnerability with no publicly proven exploit code and confirmed vendor reporting. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Technical ContextAI
CWE-346 (Origin Validation Error) describes a failure to properly verify that a resource originates from a trusted origin before processing or acting upon it. In a Chromium-based browser context, this class of flaw typically manifests as a bypass of the Same-Origin Policy (SOP) or Cross-Origin Resource Sharing (CORS) enforcement - allowing attacker-controlled content to impersonate or access resources belonging to a different origin. The affected product is confirmed via CPE cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:* covering all versions of Edge based on the Chromium engine. The Chromium-based Edge inherits the Blink rendering engine and V8 JavaScript runtime, where origin validation logic governs navigation, messaging, and resource-fetch boundaries. Errors in this logic can permit cross-origin data reads or UI spoofing, consistent with the reported confidentiality and integrity impact.
RemediationAI
Apply the vendor-released patch via the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66322. Edge updates are distributed through Microsoft Update, the Microsoft Store, and enterprise deployment channels (WSUS, Intune). The exact fixed version number was not independently confirmed in the supplied data - consult the MSRC advisory directly to verify the minimum safe version for your deployment. As a compensating control where immediate patching is not feasible, restricting Edge from accessing sensitive internal web applications or enforcing Strict-Origin navigation policies at the network layer can reduce the blast radius of a successful exploit, though these controls do not eliminate the underlying flaw. Note that blocking JavaScript execution broadly would prevent exploitation of most browser-based origin confusion but would severely impair usability.
Security-feature bypass in Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 lets a remote, unauthenticate
Remote code execution in Microsoft Edge (Chromium-based) before 151.0.4129.59 allows a network attacker to run arbitrary
Remote code execution via buffer over-read in Microsoft Edge (Chromium-based) versions prior to 151.0.4129.59 affects au
Remote code execution in Microsoft Edge (Chromium-based) prior to version 151.0.4129.59 is achievable by an unauthentica
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free memory corruption flaw (CWE-416) th
Remote code execution in Microsoft Edge (Chromium-based) allows an unauthenticated attacker to run arbitrary code by lur
Remote code execution in Microsoft Edge (Chromium-based) stems from a heap-based buffer overflow (CWE-122) that a networ
Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can
Remote code execution in Microsoft Edge (Chromium-based) before version 150.0.4078.48 allows an unauthenticated remote a
Remote code execution in Microsoft Edge (Chromium-based) stems from a use-after-free (CWE-416) memory-corruption flaw th
Remote code execution in Microsoft Edge (Chromium-based) lets an unauthenticated network attacker run arbitrary code by
Remote code execution in Microsoft Edge (Chromium-based) before 150.0.4078.48 allows an unauthenticated attacker to run
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today