Search
Find a vulnerability
Search criteria
38065 vulnerabilities by Microsoft
CVE-2026-109469 (GCVE-0-2026-109469)
Vulnerability from nvd – Published: 2026-11-06 23:06 – Updated: 2026-11-06 23:06 Exclusively Hosted Service
VLAI
EPSS
VEX
Title
Entra Device Registration Elevation of Privilege Vulnerability
Summary
Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Entra Device Registration |
Affected:
-
cpe:2.3:a:microsoft:entra_device_registration:*:*:*:*:*:*:*:* |
Date Public
2026-11-05 16:00
{
"containers": {
"cna": {
"affected": [
{
"product": "Entra Device Registration",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "-"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:entra_device_registration:*:*:*:*:*:*:*:*",
"versionStartIncluding": "-",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-11-05T16:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T23:06:41.546Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Entra Device Registration Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109469"
}
],
"tags": [
"exclusively-hosted-service"
],
"title": "Entra Device Registration Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-109469",
"datePublished": "2026-11-06T23:06:41.546Z",
"dateReserved": "2026-10-12T17:01:11.370Z",
"dateUpdated": "2026-11-06T23:06:41.546Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118147 (GCVE-0-2026-118147)
Vulnerability from nvd – Published: 2026-10-31 18:13 – Updated: 2026-11-07 04:55
VLAI
EPSS
VEX
Title
Visual Studio Spoofing Vulnerability
Summary
Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 00:00 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Visual Studio 2017 version 15.9 |
Affected:
15.9.0 , < 15.9.84
(custom)
|
|
| Microsoft | Microsoft Visual Studio 2019 version 16.11 |
Affected:
16.11.0 , < 16.11.62
(custom)
|
|
| Microsoft | Microsoft Visual Studio 2022 version 17.14 |
Affected:
17.14.0 , < 17.14.44
(custom)
|
|
| Microsoft | Microsoft Visual Studio 2026 version 18.11 |
Affected:
18.11.0 , < 18.11.3
(custom)
|
Date Public
2026-10-30 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118147",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T04:55:19.092Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Visual Studio 2017 version 15.9",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "15.9.84",
"status": "affected",
"version": "15.9.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Visual Studio 2019 version 16.11",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.11.62",
"status": "affected",
"version": "16.11.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Visual Studio 2022 version 17.14",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "17.14.44",
"status": "affected",
"version": "17.14.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Visual Studio 2026 version 18.11",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "18.11.3",
"status": "affected",
"version": "18.11.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.11:*:*:*:*:*:*:*:*",
"versionEndExcluding": "18.11.3",
"versionStartIncluding": "18.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:microsoft_visual_studio_2017_version_15.9:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15.9.84",
"versionStartIncluding": "15.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:microsoft_visual_studio_2019_version_16.11:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.11.62",
"versionStartIncluding": "16.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.14.44",
"versionStartIncluding": "17.14.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-30T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295: Improper Certificate Validation",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:37.059Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Visual Studio Spoofing Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118147"
}
],
"title": "Visual Studio Spoofing Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-118147",
"datePublished": "2026-10-31T18:13:37.059Z",
"dateReserved": "2026-10-27T17:35:36.727Z",
"dateUpdated": "2026-11-07T04:55:19.092Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69446 (GCVE-0-2026-69446)
Vulnerability from nvd – Published: 2026-10-30 17:23 – Updated: 2026-10-31 03:56
VLAI
EPSS
VEX
Title
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Summary
Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 00:00 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 152.0.4191.53
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-08-28 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69446",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T03:56:42.238Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "152.0.4191.53",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "152.0.4191.53",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-08-28T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:23:20.903Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69446"
}
],
"title": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-69446",
"datePublished": "2026-10-30T17:23:20.903Z",
"dateReserved": "2026-08-03T20:59:32.785Z",
"dateUpdated": "2026-10-31T03:56:42.238Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96203 (GCVE-0-2026-96203)
Vulnerability from nvd – Published: 2026-10-29 15:21 – Updated: 2026-10-31 18:13
VLAI
EPSS
VEX
Title
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Summary
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 03:56 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 155.0.4283.45
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-10-26 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96203",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T03:56:32.647654Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:18:26.226Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "155.0.4283.45",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "155.0.4283.45",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-26T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:33.074Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96203"
}
],
"title": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-96203",
"datePublished": "2026-10-29T15:21:46.378Z",
"dateReserved": "2026-09-22T18:57:22.165Z",
"dateUpdated": "2026-10-31T18:13:33.074Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96199 (GCVE-0-2026-96199)
Vulnerability from nvd – Published: 2026-10-29 15:09 – Updated: 2026-10-31 18:01
VLAI
EPSS
VEX
Title
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Summary
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 03:56 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 154.0.4258.37
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-10-16 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96199",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T03:56:20.232480Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:18:27.894Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "154.0.4258.37",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "154.0.4258.37",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-16T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:01:14.611Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96199"
}
],
"title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-96199",
"datePublished": "2026-10-29T15:09:08.945Z",
"dateReserved": "2026-09-22T18:48:47.472Z",
"dateUpdated": "2026-10-31T18:01:14.611Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96198 (GCVE-0-2026-96198)
Vulnerability from nvd – Published: 2026-10-29 15:09 – Updated: 2026-10-31 18:01
VLAI
EPSS
VEX
Title
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Summary
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 03:56 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 154.0.4258.37
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-10-16 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96198",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T03:56:19.260768Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:18:28.055Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "154.0.4258.37",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "154.0.4258.37",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-16T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:01:14.078Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96198"
}
],
"title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-96198",
"datePublished": "2026-10-29T15:09:08.400Z",
"dateReserved": "2026-09-22T18:48:47.472Z",
"dateUpdated": "2026-10-31T18:01:14.078Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96196 (GCVE-0-2026-96196)
Vulnerability from nvd – Published: 2026-10-29 15:21 – Updated: 2026-10-31 18:13
VLAI
EPSS
VEX
Title
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Summary
Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 03:56 UTC
CWE
- CWE-184 - Incomplete List of Disallowed Inputs
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 156.0.4314.50
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-10-27 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96196",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T03:56:35.017904Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:18:25.810Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "156.0.4314.50",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "156.0.4314.50",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-27T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-184",
"description": "CWE-184: Incomplete List of Disallowed Inputs",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:38.267Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96196"
}
],
"title": "Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-96196",
"datePublished": "2026-10-29T15:21:50.749Z",
"dateReserved": "2026-09-22T18:48:47.472Z",
"dateUpdated": "2026-10-31T18:13:38.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96192 (GCVE-0-2026-96192)
Vulnerability from nvd – Published: 2026-10-29 15:21 – Updated: 2026-10-31 18:13
VLAI
EPSS
VEX
Title
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Summary
Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 03:56 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 155.0.4283.45
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-10-26 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96192",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T03:56:31.811825Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:18:26.369Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "155.0.4283.45",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "155.0.4283.45",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-26T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:32.565Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96192"
}
],
"title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-96192",
"datePublished": "2026-10-29T15:21:45.832Z",
"dateReserved": "2026-09-22T18:48:47.471Z",
"dateUpdated": "2026-10-31T18:13:32.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96187 (GCVE-0-2026-96187)
Vulnerability from nvd – Published: 2026-10-29 15:21 – Updated: 2026-10-31 18:13
VLAI
EPSS
VEX
Title
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Summary
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 13:38 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 155.0.4283.45
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-10-26 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96187",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T13:38:07.997435Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T13:46:52.432Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "155.0.4283.45",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "155.0.4283.45",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-26T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Access of resource using incompatible type (\u0027type confusion\u0027) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:36.114Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96187"
}
],
"title": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-96187",
"datePublished": "2026-10-29T15:21:49.667Z",
"dateReserved": "2026-09-22T18:48:47.471Z",
"dateUpdated": "2026-10-31T18:13:36.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88090 (GCVE-0-2026-88090)
Vulnerability from nvd – Published: 2026-10-29 15:21 – Updated: 2026-10-31 18:13
VLAI
EPSS
VEX
Title
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Summary
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 03:56 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 154.0.4258.37
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-10-26 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88090",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T03:56:33.394305Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:18:26.091Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "154.0.4258.37",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "154.0.4258.37",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-26T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Access of resource using incompatible type (\u0027type confusion\u0027) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:34.611Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88090"
}
],
"title": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-88090",
"datePublished": "2026-10-29T15:21:48.152Z",
"dateReserved": "2026-09-09T21:47:30.203Z",
"dateUpdated": "2026-10-31T18:13:34.611Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88078 (GCVE-0-2026-88078)
Vulnerability from nvd – Published: 2026-10-29 15:21 – Updated: 2026-10-31 18:13
VLAI
EPSS
VEX
Title
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Summary
Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 13:37 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 156.0.4314.42
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-10-27 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88078",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T13:37:57.479805Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T13:46:52.296Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "156.0.4314.42",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "156.0.4314.42",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-27T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:37.641Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88078"
}
],
"title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-88078",
"datePublished": "2026-10-29T15:21:52.370Z",
"dateReserved": "2026-09-09T21:47:30.202Z",
"dateUpdated": "2026-10-31T18:13:37.641Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88077 (GCVE-0-2026-88077)
Vulnerability from nvd – Published: 2026-10-29 15:21 – Updated: 2026-10-31 18:13
VLAI
EPSS
VEX
Title
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Summary
Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 03:56 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 154.0.4258.62
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-10-26 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88077",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T03:56:35.758065Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:18:25.673Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "154.0.4258.62",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "154.0.4258.62",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-26T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:40.054Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88077"
}
],
"title": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-88077",
"datePublished": "2026-10-29T15:21:51.829Z",
"dateReserved": "2026-09-09T21:47:30.202Z",
"dateUpdated": "2026-10-31T18:13:40.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85899 (GCVE-0-2026-85899)
Vulnerability from nvd – Published: 2026-10-29 15:21 – Updated: 2026-10-31 18:13
VLAI
EPSS
VEX
Title
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Summary
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 03:56 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 155.0.4283.45
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-10-26 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85899",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T03:56:34.266155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:18:25.956Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "155.0.4283.45",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "155.0.4283.45",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-26T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:35.612Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85899"
}
],
"title": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-85899",
"datePublished": "2026-10-29T15:21:49.145Z",
"dateReserved": "2026-09-04T18:21:15.992Z",
"dateUpdated": "2026-10-31T18:13:35.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85897 (GCVE-0-2026-85897)
Vulnerability from nvd – Published: 2026-10-29 15:09 – Updated: 2026-10-31 18:01
VLAI
EPSS
VEX
Title
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Summary
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 03:56 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 154.0.4258.37
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-10-16 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85897",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T03:56:18.453394Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:18:28.208Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "154.0.4258.37",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "154.0.4258.37",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-16T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:01:12.960Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85897"
}
],
"title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-85897",
"datePublished": "2026-10-29T15:09:07.330Z",
"dateReserved": "2026-09-04T18:21:15.992Z",
"dateUpdated": "2026-10-31T18:01:12.960Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85890 (GCVE-0-2026-85890)
Vulnerability from nvd – Published: 2026-10-29 15:09 – Updated: 2026-10-31 18:01
VLAI
EPSS
VEX
Title
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Summary
Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 03:56 UTC
CWE
- CWE-415 - Double Free
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 154.0.4258.37
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-10-16 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85890",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T03:56:17.714627Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:18:28.365Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "154.0.4258.37",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "154.0.4258.37",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-16T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "CWE-415: Double Free",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:01:12.499Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85890"
}
],
"title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-85890",
"datePublished": "2026-10-29T15:09:06.731Z",
"dateReserved": "2026-09-04T18:18:19.328Z",
"dateUpdated": "2026-10-31T18:01:12.499Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85330 (GCVE-0-2026-85330)
Vulnerability from nvd – Published: 2026-10-29 15:21 – Updated: 2026-10-31 18:13
VLAI
EPSS
VEX
Title
Microsoft Edge for Android Security Feature Bypass Vulnerability
Summary
Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 13:38 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 155.0.4283.45
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-10-26 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85330",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T13:38:12.885270Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T13:46:52.566Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "155.0.4283.45",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "155.0.4283.45",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-26T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:35.114Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge for Android Security Feature Bypass Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85330"
}
],
"title": "Microsoft Edge for Android Security Feature Bypass Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-85330",
"datePublished": "2026-10-29T15:21:48.611Z",
"dateReserved": "2026-09-03T17:01:56.595Z",
"dateUpdated": "2026-10-31T18:13:35.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-20942 (GCVE-0-2026-20942)
Vulnerability from nvd – Published: 2026-10-29 15:21 – Updated: 2026-10-31 18:13
VLAI
EPSS
VEX
Title
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Summary
Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 13:38 UTC
CWE
- CWE-1021 - Improper Restriction of Rendered UI Layers or Frames
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 156.0.4314.42
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-10-27 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-20942",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T13:38:48.039402Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T13:46:52.834Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "156.0.4314.42",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "156.0.4314.42",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-27T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1021",
"description": "CWE-1021: Improper Restriction of Rendered UI Layers or Frames",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:33.579Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20942"
}
],
"title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-20942",
"datePublished": "2026-10-29T15:21:46.978Z",
"dateReserved": "2025-12-04T20:04:16.338Z",
"dateUpdated": "2026-10-31T18:13:33.579Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114148 (GCVE-0-2026-114148)
Vulnerability from nvd – Published: 2026-10-29 15:21 – Updated: 2026-10-31 18:13
VLAI
EPSS
VEX
Title
ASP.NET Core Elevation of Privilege Vulnerability
Summary
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 13:38 UTC
CWE
- CWE-276 - Incorrect Default Permissions
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
14 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | .NET 10.0 installed on Linux |
Affected:
10.0.0 , < 10.0.403
(custom)
|
|
| Microsoft | .NET 10.0 installed on Mac OS |
Affected:
10.0.0 , < 10.0.403
(custom)
|
|
| Microsoft | .NET 10.0 installed on Windows |
Affected:
10.0.0 , < 10.0.403
(custom)
|
|
| Microsoft | .NET 11.0 installed on Linux |
Affected:
11.0.0-preview.1 , < 11.0.100-rc.3
(custom)
|
|
| Microsoft | .NET 11.0 installed on Mac OS |
Affected:
11.0.0-preview.1 , < 11.0.100-rc.3
(custom)
|
|
| Microsoft | .NET 11.0 installed on Windows |
Affected:
11.0.0-preview.1 , < 11.0.100-rc.3
(custom)
|
|
| Microsoft | .NET 8.0 installed on Linux |
Affected:
8.0.0 , < 8.0.427
(custom)
|
|
| Microsoft | .NET 8.0 installed on Mac OS |
Affected:
8.0.0 , < 8.0.427
(custom)
|
|
| Microsoft | .NET 8.0 installed on Windows |
Affected:
8.0.0 , < 8.0.427
(custom)
|
|
| Microsoft | .NET 9.0 installed on Linux |
Affected:
9.0.0 , < 9.0.320
(custom)
|
|
| Microsoft | .NET 9.0 installed on Mac OS |
Affected:
9.0.0 , < 9.0.320
(custom)
|
|
| Microsoft | .NET 9.0 installed on Windows |
Affected:
9.0.0 , < 9.0.320
(custom)
|
|
| Microsoft | .NET source-build Linux tarballs (all archive types) |
Affected:
8.0.100 , < 10.0.403-servicing.26523.112
(custom)
|
|
| Microsoft | ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published) |
Affected:
8.0.0 , < 9.0.22
(custom)
|
Date Public
2026-10-25 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114148",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T13:38:21.442156Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T13:46:52.704Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": ".NET 10.0 installed on Linux",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.403",
"status": "affected",
"version": "10.0.0",
"versionType": "custom"
}
]
},
{
"product": ".NET 10.0 installed on Mac OS",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.403",
"status": "affected",
"version": "10.0.0",
"versionType": "custom"
}
]
},
{
"product": ".NET 10.0 installed on Windows",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.403",
"status": "affected",
"version": "10.0.0",
"versionType": "custom"
}
]
},
{
"product": ".NET 11.0 installed on Linux",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "11.0.100-rc.3",
"status": "affected",
"version": "11.0.0-preview.1",
"versionType": "custom"
}
]
},
{
"product": ".NET 11.0 installed on Mac OS",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "11.0.100-rc.3",
"status": "affected",
"version": "11.0.0-preview.1",
"versionType": "custom"
}
]
},
{
"product": ".NET 11.0 installed on Windows",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "11.0.100-rc.3",
"status": "affected",
"version": "11.0.0-preview.1",
"versionType": "custom"
}
]
},
{
"product": ".NET 8.0 installed on Linux",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "8.0.427",
"status": "affected",
"version": "8.0.0",
"versionType": "custom"
}
]
},
{
"product": ".NET 8.0 installed on Mac OS",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "8.0.427",
"status": "affected",
"version": "8.0.0",
"versionType": "custom"
}
]
},
{
"product": ".NET 8.0 installed on Windows",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "8.0.427",
"status": "affected",
"version": "8.0.0",
"versionType": "custom"
}
]
},
{
"product": ".NET 9.0 installed on Linux",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "9.0.320",
"status": "affected",
"version": "9.0.0",
"versionType": "custom"
}
]
},
{
"product": ".NET 9.0 installed on Mac OS",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "9.0.320",
"status": "affected",
"version": "9.0.0",
"versionType": "custom"
}
]
},
{
"product": ".NET 9.0 installed on Windows",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "9.0.320",
"status": "affected",
"version": "9.0.0",
"versionType": "custom"
}
]
},
{
"product": ".NET source-build Linux tarballs (all archive types)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.403-servicing.26523.112",
"status": "affected",
"version": "8.0.100",
"versionType": "custom"
}
]
},
{
"product": "ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "9.0.22",
"status": "affected",
"version": "8.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:.net_8.0_installed_on_windows:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.0.427",
"versionStartIncluding": "8.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:.net_8.0_installed_on_linux:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.0.427",
"versionStartIncluding": "8.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:.net_8.0_installed_on_mac_os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.0.427",
"versionStartIncluding": "8.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:.net_9.0_installed_on_windows:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.0.320",
"versionStartIncluding": "9.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:.net_9.0_installed_on_linux:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.0.320",
"versionStartIncluding": "9.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:.net_9.0_installed_on_mac_os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.0.320",
"versionStartIncluding": "9.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:.net_10.0_installed_on_windows:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.403",
"versionStartIncluding": "10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:.net_10.0_installed_on_linux:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.403",
"versionStartIncluding": "10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:.net_10.0_installed_on_mac_os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.403",
"versionStartIncluding": "10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:.net_11.0_installed_on_windows:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.0.100-rc.3",
"versionStartIncluding": "11.0.0-preview.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:.net_11.0_installed_on_linux:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.0.100-rc.3",
"versionStartIncluding": "11.0.0-preview.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:.net_11.0_installed_on_mac_os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.0.100-rc.3",
"versionStartIncluding": "11.0.0-preview.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:asp_net_core_runtime_and_targeting-pack_linux_tarballs_microsoft_published:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.0.22",
"versionStartIncluding": "8.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:.net_source-build_linux_tarballs_all_archive_types:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.403-servicing.26523.112",
"versionStartIncluding": "8.0.100",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-25T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276: Incorrect Default Permissions",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:34.093Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "ASP.NET Core Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148"
}
],
"title": "ASP.NET Core Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-114148",
"datePublished": "2026-10-29T15:21:47.615Z",
"dateReserved": "2026-10-20T21:56:39.316Z",
"dateUpdated": "2026-10-31T18:13:34.093Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109469 (GCVE-0-2026-109469)
Vulnerability from cvelistv5 – Published: 2026-11-06 23:06 – Updated: 2026-11-06 23:06 Exclusively Hosted Service
VLAI
EPSS
VEX
Title
Entra Device Registration Elevation of Privilege Vulnerability
Summary
Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Entra Device Registration |
Affected:
-
cpe:2.3:a:microsoft:entra_device_registration:*:*:*:*:*:*:*:* |
Date Public
2026-11-05 16:00
{
"containers": {
"cna": {
"affected": [
{
"product": "Entra Device Registration",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "-"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:entra_device_registration:*:*:*:*:*:*:*:*",
"versionStartIncluding": "-",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-11-05T16:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T23:06:41.546Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Entra Device Registration Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109469"
}
],
"tags": [
"exclusively-hosted-service"
],
"title": "Entra Device Registration Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-109469",
"datePublished": "2026-11-06T23:06:41.546Z",
"dateReserved": "2026-10-12T17:01:11.370Z",
"dateUpdated": "2026-11-06T23:06:41.546Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118147 (GCVE-0-2026-118147)
Vulnerability from cvelistv5 – Published: 2026-10-31 18:13 – Updated: 2026-11-07 04:55
VLAI
EPSS
VEX
Title
Visual Studio Spoofing Vulnerability
Summary
Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 00:00 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Visual Studio 2017 version 15.9 |
Affected:
15.9.0 , < 15.9.84
(custom)
|
|
| Microsoft | Microsoft Visual Studio 2019 version 16.11 |
Affected:
16.11.0 , < 16.11.62
(custom)
|
|
| Microsoft | Microsoft Visual Studio 2022 version 17.14 |
Affected:
17.14.0 , < 17.14.44
(custom)
|
|
| Microsoft | Microsoft Visual Studio 2026 version 18.11 |
Affected:
18.11.0 , < 18.11.3
(custom)
|
Date Public
2026-10-30 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118147",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T04:55:19.092Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Visual Studio 2017 version 15.9",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "15.9.84",
"status": "affected",
"version": "15.9.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Visual Studio 2019 version 16.11",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.11.62",
"status": "affected",
"version": "16.11.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Visual Studio 2022 version 17.14",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "17.14.44",
"status": "affected",
"version": "17.14.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Visual Studio 2026 version 18.11",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "18.11.3",
"status": "affected",
"version": "18.11.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.11:*:*:*:*:*:*:*:*",
"versionEndExcluding": "18.11.3",
"versionStartIncluding": "18.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:microsoft_visual_studio_2017_version_15.9:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15.9.84",
"versionStartIncluding": "15.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:microsoft_visual_studio_2019_version_16.11:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.11.62",
"versionStartIncluding": "16.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.14.44",
"versionStartIncluding": "17.14.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-30T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295: Improper Certificate Validation",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:37.059Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Visual Studio Spoofing Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118147"
}
],
"title": "Visual Studio Spoofing Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-118147",
"datePublished": "2026-10-31T18:13:37.059Z",
"dateReserved": "2026-10-27T17:35:36.727Z",
"dateUpdated": "2026-11-07T04:55:19.092Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69446 (GCVE-0-2026-69446)
Vulnerability from cvelistv5 – Published: 2026-10-30 17:23 – Updated: 2026-10-31 03:56
VLAI
EPSS
VEX
Title
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Summary
Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 00:00 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 152.0.4191.53
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-08-28 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69446",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T03:56:42.238Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "152.0.4191.53",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "152.0.4191.53",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-08-28T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:23:20.903Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69446"
}
],
"title": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-69446",
"datePublished": "2026-10-30T17:23:20.903Z",
"dateReserved": "2026-08-03T20:59:32.785Z",
"dateUpdated": "2026-10-31T03:56:42.238Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88078 (GCVE-0-2026-88078)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:21 – Updated: 2026-10-31 18:13
VLAI
EPSS
VEX
Title
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Summary
Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 13:37 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 156.0.4314.42
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-10-27 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88078",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T13:37:57.479805Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T13:46:52.296Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "156.0.4314.42",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "156.0.4314.42",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-27T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:37.641Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge (Chromium-based) Spoofing Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88078"
}
],
"title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-88078",
"datePublished": "2026-10-29T15:21:52.370Z",
"dateReserved": "2026-09-09T21:47:30.202Z",
"dateUpdated": "2026-10-31T18:13:37.641Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88077 (GCVE-0-2026-88077)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:21 – Updated: 2026-10-31 18:13
VLAI
EPSS
VEX
Title
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Summary
Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 03:56 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 154.0.4258.62
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-10-26 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88077",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T03:56:35.758065Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:18:25.673Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "154.0.4258.62",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "154.0.4258.62",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-26T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:40.054Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88077"
}
],
"title": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-88077",
"datePublished": "2026-10-29T15:21:51.829Z",
"dateReserved": "2026-09-09T21:47:30.202Z",
"dateUpdated": "2026-10-31T18:13:40.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96196 (GCVE-0-2026-96196)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:21 – Updated: 2026-10-31 18:13
VLAI
EPSS
VEX
Title
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Summary
Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 03:56 UTC
CWE
- CWE-184 - Incomplete List of Disallowed Inputs
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 156.0.4314.50
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-10-27 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96196",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T03:56:35.017904Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:18:25.810Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "156.0.4314.50",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "156.0.4314.50",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-27T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-184",
"description": "CWE-184: Incomplete List of Disallowed Inputs",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:38.267Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96196"
}
],
"title": "Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-96196",
"datePublished": "2026-10-29T15:21:50.749Z",
"dateReserved": "2026-09-22T18:48:47.472Z",
"dateUpdated": "2026-10-31T18:13:38.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96187 (GCVE-0-2026-96187)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:21 – Updated: 2026-10-31 18:13
VLAI
EPSS
VEX
Title
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Summary
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 13:38 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 155.0.4283.45
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-10-26 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96187",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T13:38:07.997435Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T13:46:52.432Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "155.0.4283.45",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "155.0.4283.45",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-26T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Access of resource using incompatible type (\u0027type confusion\u0027) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:36.114Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96187"
}
],
"title": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-96187",
"datePublished": "2026-10-29T15:21:49.667Z",
"dateReserved": "2026-09-22T18:48:47.471Z",
"dateUpdated": "2026-10-31T18:13:36.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85899 (GCVE-0-2026-85899)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:21 – Updated: 2026-10-31 18:13
VLAI
EPSS
VEX
Title
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Summary
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 03:56 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 155.0.4283.45
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-10-26 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85899",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T03:56:34.266155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:18:25.956Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "155.0.4283.45",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "155.0.4283.45",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-26T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:35.612Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85899"
}
],
"title": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-85899",
"datePublished": "2026-10-29T15:21:49.145Z",
"dateReserved": "2026-09-04T18:21:15.992Z",
"dateUpdated": "2026-10-31T18:13:35.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85330 (GCVE-0-2026-85330)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:21 – Updated: 2026-10-31 18:13
VLAI
EPSS
VEX
Title
Microsoft Edge for Android Security Feature Bypass Vulnerability
Summary
Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 13:38 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Edge (Chromium-based) |
Affected:
1.0.0.0 , < 155.0.4283.45
(custom)
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* |
Date Public
2026-10-26 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85330",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T13:38:12.885270Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T13:46:52.566Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Edge (Chromium-based)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "155.0.4283.45",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
"versionEndExcluding": "155.0.4283.45",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-26T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:35.114Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Edge for Android Security Feature Bypass Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85330"
}
],
"title": "Microsoft Edge for Android Security Feature Bypass Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-85330",
"datePublished": "2026-10-29T15:21:48.611Z",
"dateReserved": "2026-09-03T17:01:56.595Z",
"dateUpdated": "2026-10-31T18:13:35.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CERTFR-2026-AVI-1466
Vulnerability from certfr_avis - Published: 2026-11-05 - Updated: 2026-11-05
De multiples vulnérabilités ont été découvertes dans Microsoft Edge. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Edge versions ant\u00e9rieures \u00e0 156.0.4314.58",
"product": {
"name": "Edge",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-76029",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76029"
},
{
"name": "CVE-2026-76027",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76027"
},
{
"name": "CVE-2026-76030",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76030"
},
{
"name": "CVE-2026-118321",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118321"
},
{
"name": "CVE-2026-76025",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76025"
},
{
"name": "CVE-2026-119269",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-119269"
},
{
"name": "CVE-2026-119270",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-119270"
},
{
"name": "CVE-2026-119261",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-119261"
},
{
"name": "CVE-2026-119272",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-119272"
},
{
"name": "CVE-2026-76031",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76031"
},
{
"name": "CVE-2026-76024",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76024"
},
{
"name": "CVE-2026-118314",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118314"
},
{
"name": "CVE-2026-119271",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-119271"
},
{
"name": "CVE-2026-119262",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-119262"
},
{
"name": "CVE-2026-122518",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-122518"
},
{
"name": "CVE-2026-119264",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-119264"
},
{
"name": "CVE-2026-118309",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118309"
},
{
"name": "CVE-2026-119260",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-119260"
},
{
"name": "CVE-2026-119266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-119266"
},
{
"name": "CVE-2026-119263",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-119263"
},
{
"name": "CVE-2026-76026",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76026"
},
{
"name": "CVE-2026-119267",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-119267"
},
{
"name": "CVE-2026-119265",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-119265"
},
{
"name": "CVE-2026-119268",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-119268"
},
{
"name": "CVE-2026-76028",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76028"
}
],
"initial_release_date": "2026-11-05T00:00:00",
"last_revision_date": "2026-11-05T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1466",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-11-05T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Microsoft Edge. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Edge",
"vendor_advisories": [
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-119272",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119272"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118309",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118309"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-119263",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119263"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-119265",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119265"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-76027",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-76027"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118321",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118321"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-119271",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119271"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118314",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118314"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-76028",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-76028"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-76024",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-76024"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-119268",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119268"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-119267",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119267"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-119264",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119264"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-76029",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-76029"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-122518",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-122518"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-76031",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-76031"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-119262",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119262"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-119260",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119260"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-119270",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119270"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-76030",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-76030"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-76026",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-76026"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-119266",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119266"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-119269",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119269"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-76025",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-76025"
},
{
"published_at": "2026-11-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-119261",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119261"
}
]
}
CERTFR-2026-AVI-1440
Vulnerability from certfr_avis - Published: 2026-11-02 - Updated: 2026-11-02
De multiples vulnérabilités ont été découvertes dans Microsoft Edge. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Edge versions ant\u00e9rieures \u00e0 153.0.4234.46",
"product": {
"name": "Edge",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Edge versions ant\u00e9rieures \u00e0 156.0.4314.56",
"product": {
"name": "Edge",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-118340",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118340"
},
{
"name": "CVE-2026-118310",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118310"
},
{
"name": "CVE-2026-118339",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118339"
},
{
"name": "CVE-2026-118359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118359"
},
{
"name": "CVE-2026-118315",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118315"
},
{
"name": "CVE-2026-118328",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118328"
},
{
"name": "CVE-2026-118355",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118355"
},
{
"name": "CVE-2026-118334",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118334"
},
{
"name": "CVE-2026-118329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118329"
},
{
"name": "CVE-2026-118349",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118349"
},
{
"name": "CVE-2026-118332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118332"
},
{
"name": "CVE-2026-118345",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118345"
},
{
"name": "CVE-2026-118320",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118320"
},
{
"name": "CVE-2026-118335",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118335"
},
{
"name": "CVE-2026-118307",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118307"
},
{
"name": "CVE-2026-118350",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118350"
},
{
"name": "CVE-2026-118317",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118317"
},
{
"name": "CVE-2026-118338",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118338"
},
{
"name": "CVE-2026-118316",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118316"
},
{
"name": "CVE-2026-118330",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118330"
},
{
"name": "CVE-2026-118331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118331"
},
{
"name": "CVE-2026-118313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118313"
},
{
"name": "CVE-2026-118354",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118354"
},
{
"name": "CVE-2026-118352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118352"
},
{
"name": "CVE-2026-118347",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118347"
},
{
"name": "CVE-2026-118308",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118308"
},
{
"name": "CVE-2026-118319",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118319"
},
{
"name": "CVE-2026-118346",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118346"
},
{
"name": "CVE-2026-118344",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118344"
},
{
"name": "CVE-2026-118357",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118357"
},
{
"name": "CVE-2026-118348",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118348"
},
{
"name": "CVE-2026-118318",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118318"
},
{
"name": "CVE-2026-91732",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91732"
},
{
"name": "CVE-2026-118356",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118356"
},
{
"name": "CVE-2026-118311",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118311"
},
{
"name": "CVE-2026-118342",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118342"
},
{
"name": "CVE-2026-118322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118322"
},
{
"name": "CVE-2026-118306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118306"
},
{
"name": "CVE-2026-118304",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118304"
},
{
"name": "CVE-2026-118353",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118353"
},
{
"name": "CVE-2026-118327",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118327"
},
{
"name": "CVE-2026-118337",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118337"
},
{
"name": "CVE-2026-118312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118312"
},
{
"name": "CVE-2026-118351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118351"
},
{
"name": "CVE-2026-118305",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118305"
},
{
"name": "CVE-2026-118333",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118333"
},
{
"name": "CVE-2026-118336",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118336"
},
{
"name": "CVE-2026-118343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118343"
},
{
"name": "CVE-2026-118358",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118358"
},
{
"name": "CVE-2026-118341",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118341"
}
],
"initial_release_date": "2026-11-02T00:00:00",
"last_revision_date": "2026-11-02T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1440",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-11-02T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Microsoft Edge. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Edge",
"vendor_advisories": [
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118331",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118331"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118343",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118343"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118330",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118330"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118318",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118318"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118339",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118339"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118340",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118340"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118305",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118305"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118310",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118310"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118334",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118334"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118319",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118319"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118315",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118315"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118349",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118349"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118352",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118352"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118356",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118356"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118341",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118341"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118332",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118332"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118348",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118348"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118345",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118345"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118342",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118342"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118327",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118327"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118317",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118317"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118338",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118338"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118322",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118322"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118336",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118336"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118311",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118311"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118350",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118350"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118353",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118353"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118358",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118358"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118344",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118344"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118307",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118307"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118312",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118312"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118354",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118354"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118347",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118347"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118328",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118328"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118337",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118337"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118320",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118320"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118357",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118357"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118329",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118329"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118304",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118304"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118316",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118316"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118313",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118313"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118333",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118333"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118351",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118351"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118346",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118346"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118355",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118355"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118308",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118308"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-91732",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-91732"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118306",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118306"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118335",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118335"
},
{
"published_at": "2026-10-31",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Edge CVE-2026-118359",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118359"
}
]
}
CERTFR-2026-AVI-1441
Vulnerability from certfr_avis - Published: 2026-11-02 - Updated: 2026-11-02
Une vulnérabilité a été découverte dans Microsoft Visual Studio. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | Visual Studio Code | Microsoft Visual Studio 2019 version 16.11 antérieures à 16.11.62 | ||
| Microsoft | Visual Studio Code | Microsoft Visual Studio 2026 version 18.11 antérieures à 18.11.3 | ||
| Microsoft | Visual Studio Code | Microsoft Visual Studio 2022 version 17.14 antérieures à 17.14.44 | ||
| Microsoft | Visual Studio Code | Microsoft Visual Studio 2017 version 15.9 antérieures à 15.9.84 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Visual Studio 2019 version 16.11 ant\u00e9rieures \u00e0 16.11.62",
"product": {
"name": "Visual Studio Code",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2026 version 18.11 ant\u00e9rieures \u00e0 18.11.3",
"product": {
"name": "Visual Studio Code",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.14 ant\u00e9rieures \u00e0 17.14.44",
"product": {
"name": "Visual Studio Code",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2017 version 15.9 ant\u00e9rieures \u00e0 15.9.84",
"product": {
"name": "Visual Studio Code",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-118147",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118147"
}
],
"initial_release_date": "2026-11-02T00:00:00",
"last_revision_date": "2026-11-02T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1441",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-11-02T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Microsoft Visual Studio. Elle permet \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Vuln\u00e9rabilit\u00e9 dans Microsoft Visual Studio",
"vendor_advisories": [
{
"published_at": "2026-10-30",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-118147",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118147"
}
]
}