Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

Microsoft Edge can let attackers gain higher rights

CVE-2026-88090 · published 6 days ago
Summary

The Chromium‑based Microsoft Edge web browser may allow a malicious user on the network to trick it into treating data as the wrong type, which can raise the attacker’s access level. This could let them perform actions they normally could not. Apply the latest security update from Microsoft as soon as possible to fix the issue.

What to do
  • Update microsoft microsoft edge (chromium-based) to version 154.0.4258.37 or later.
  • Update microsoft edge_chromium to version 154.0.4258.37 or later.
Affected software
VendorProductAffected versions
microsoft microsoft edge (chromium-based) < 154.0.4258.37
microsoft edge_chromium < 154.0.4258.37
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*
Original advisory text
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-843Type Confusion
Timeline
Published29 Oct 2026
Updated4 Nov 2026
First seen29 Oct 2026
Sources
CVE-2026-88090 · NVD
CVE-2026-88090 · MITRE
Track software like this
Free during beta