Microsoft Edge Vulnerability Allows Remote Attackers to Execute Arbitrary Code
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Microsoft has released a security update addressing a critical vulnerability in Microsoft Edge that could allow remote attackers to execute arbitrary code on vulnerable systems.<\/p>\n
Tracked as CVE-2026-45495 and reported by Orange Tsai of DEVCORE, the flaw carries a CVSS v3 score of 7.5 and requires user interaction, for example, visiting a malicious webpage or opening a crafted file, to be exploited.<\/p>\n
The vulnerability stems from improper validation during Edge\u2019s processing of feedback log files. Specifically, Edge failed to properly validate a user-supplied file path before performing file operations.<\/p>\n
An attacker who can trick a user into opening a malicious file or visiting a crafted page could exploit this flaw alongside other bugs to run code in the logged-in user\u2019s context.<\/p>\n
Because the exploit runs with the current user\u2019s privileges, the impact ranges from data theft and browser profile compromise to local persistence or lateral movement where higher privileges exist.<\/p>\n
According to the public advisory<\/a>, the root cause is a path-validation defect in feedback log handling. By supplying a specially crafted path, an attacker can influence file operations in an unintended location.<\/p>\n While Microsoft\u2019s advisory does not publish exploit code, the vulnerability\u2019s characteristics (file-access path manipulation plus the need for user interaction) make social-engineering vectors malicious attachments, drive-by pages, or poisoned downloads\u2014likely delivery mechanisms.<\/p>\n Microsoft\u2019s release also coordinated updates for two additional Edge flaws discovered by the same researcher group:<\/p>\n Microsoft has published fixes and urged users and administrators to apply updates immediately. Recommended actions:<\/p>\n The vulnerabilities were reported to Microsoft on May 20, 2026, with coordinated public advisories released and updated on June 4, 2026. Orange Tsai (@orange_8361) of the DEVCORE Research Team (@d3vc0r3) is credited with the findings.<\/p>\n Administrators should prioritize the CVE-2026-45495 update given its code-execution potential and ensure patching across user endpoints to reduce exposure.<\/p>\n Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates.<\/strong><\/p>\n The post Microsoft Edge Vulnerability Allows Remote Attackers to Execute Arbitrary Code<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n\n
\n