Microsoft has patched three security vulnerabilities in its Edge browser, disclosed on June 4, 2026, as part of a coordinated release following their discovery at the Pwn2Own competition.
The flaws tracked as CVE-2026-45492, CVE-2026-45494, and CVE-2026-45495 range from origin validation bypass to a high-severity directory traversal bug that enables full remote code execution (RCE).
Critical Microsoft Edge Vulnerability
The first flaw, CVE-2026-45492, carries a CVSS score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) and is classified as an Origin Validation Error.
The vulnerability exists in Edge’s cross-device managed sign-in mechanism, where the browser fails to validate the origin of web content sufficiently.
A remote, unauthenticated attacker can exploit this flaw by tricking a user into visiting a malicious web page or opening a crafted file.
While the vulnerability’s standalone impact is limited to integrity (no confidentiality or availability impact), it can be chained with other vulnerabilities to execute arbitrary code in the current user’s context, Orange Tsai said.
The second vulnerability, CVE-2026-45494, scores 5.0 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) and is a Universal Cross-Site Scripting (UXSS) flaw stemming from improper handling of browser navigation events.
The core issue stems from insufficient validation of user-supplied data during navigation, which allows the injection of an arbitrary script.
An attacker who successfully exploits this vulnerability can execute malicious JavaScript in the context of any target domain, effectively bypassing the same-origin policy.
This class of vulnerability, UXSS, is considered especially severe because it breaches the browser’s fundamental security boundary, potentially enabling session hijacking, credential theft, or further exploitation across any website the victim visits.
The most severe of the three, CVE-2026-45495, carries a CVSS score of 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) and enables remote code execution through a directory traversal vulnerability in Edge’s feedback log file handling mechanism.
The flaw arises from a failure to validate user-supplied file paths before using them in file system operations.
An attacker who lures a victim to a malicious page can leverage this path traversal to write or manipulate files outside intended directories and, when combined with the chaining potential noted in CVE-2026-45492, can escalate to full arbitrary code execution with the current user’s privileges.
Microsoft has released patches for all three vulnerabilities through the Microsoft Security Response Center (MSRC).
Security teams should prioritize updating Microsoft Edge across all managed endpoints immediately, given the potential for RCE in CVE-2026-45495 and its chainability with the other two flaws.
All three vulnerabilities were credited to Orange Tsai (@orange_8361) of the DEVCORE Research Team (@d3vc0r3). Users running any unpatched version of Microsoft Edge should update via edge://settings/help.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
