Introduction
A remote code execution flaw in Microsoft Edge's own Chromium additions lets an attacker achieve full system compromise by luring a user to a crafted webpage. CVE-2026-45495 was patched on May 15, 2026, and carries a CVSS 3.1 base score of 8.8. It affects every Edge version prior to 148.0.3967.70, so it matters to virtually every enterprise Edge deployment that has not yet updated.
Technical Information
CVE-2026-45495 combines three weakness classes, and each one adds to how exploitable the flaw is:
- CWE-20 (Improper Input Validation): The vulnerable component lets unsafe data reach the browser engine without proper validation.
- CWE-94 (Improper Control of Generation of Code): Attacker-controlled data can influence the generation or execution of code within the browser process, which makes arbitrary code injection possible.
- CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer): Out-of-bounds operations can corrupt memory, and that corruption supplies the actual remote code execution primitive.
The three weaknesses chain together. Input validation failures (CWE-20) let malicious data reach code generation logic (CWE-94) and memory handling routines (CWE-119), and the end of that chain is arbitrary code execution in the context of the browser process.
CVSS Vector Breakdown
Microsoft's full CVSS 3.1 vector string is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value | Meaning |
|---|---|---|
| Attack Vector | Network | Exploitable remotely over the internet |
| Attack Complexity | Low | No specialized conditions required for exploitation |
| Privileges Required | None | No prior authentication needed |
| User Interaction | Required | User must take an action such as clicking a link |
| Scope | Unchanged | Impact is confined to the vulnerable component |
| Confidentiality Impact | High | Total information disclosure possible |
| Integrity Impact | High | Total compromise of system integrity |
| Availability Impact | High | Complete denial of service potential |
The temporal metrics bring the effective score down to 7.7: Exploit Code Maturity is "Unproven," Remediation Level is "Official Fix," and Report Confidence is "Confirmed."
Attack Flow
Based on the advisory details, exploitation would follow this general sequence:
- The attacker crafts a webpage with content designed to trigger the input validation, code injection, and memory corruption flaws in Edge's proprietary code paths.
- The attacker delivers the malicious URL to the target via phishing email, social engineering, a compromised website, or malicious advertising.
- The victim opens the link in a vulnerable version of Microsoft Edge (any version prior to 148.0.3967.70).
- The vulnerable Edge component processes the crafted content, which bypasses input validation and triggers memory corruption.
- The attacker achieves arbitrary code execution in the context of the browser process, with potential for full confidentiality, integrity, and availability compromise on the target system.
Edge-Specific Vulnerability
Edge did not inherit this vulnerability from upstream Chromium. The May 15 Edge release notes group CVE-2026-45495 with two sibling CVEs, CVE-2026-45494 and CVE-2026-45492, and list all three as Edge-only vulnerabilities fixed in the same build. That places the vulnerable code path in Microsoft's own additions to the Chromium codebase rather than in shared Chromium components, so other Chromium-based browsers (Chrome, Brave, Vivaldi) are not affected by this specific flaw.
The public advisories do not detail the specific browser component or rendering engine module where the memory corruption occurs.
Patch Information
Microsoft patched CVE-2026-45495 on May 15, 2026, in Microsoft Edge Stable version 148.0.3967.70, built on Chromium 148.0.7778.168. The MSRC Security Update Guide, Microsoft's Edge security release notes, and third-party vulnerability trackers all confirm the fix.
The MSRC advisory page classifies the Remediation Level as "Official Fix," which means a complete vendor solution is available rather than a workaround or temporary hotfix. The 8.8 base score drops to a 7.7 temporal score because the official fix brings the Remediation Level component down from its maximum.
Microsoft Edge is closed source, so there is no public source-level diff or commit for this fix. The patch ships only through the standard Edge auto-update mechanism. Users and administrators can confirm they are protected by checking that Edge is at version 148.0.3967.70 or later.
Enterprise administrators who manage Edge through policies or WSUS should make sure this build, or a newer one, has reached every managed endpoint. It is also worth checking that Edge update policies allow automatic updates and are not paused, since stale update policies are a common reason enterprise browsers fall behind on security patches.
Microsoft has not provided any interim workarounds or hotfixes for this vulnerability. The only documented remediation is the official patch.
Affected Systems and Versions
All Microsoft Edge (Chromium based) versions from 1.0.0.0 up to, but excluding, version 148.0.3967.70 are affected, which covers a very broad range of Edge installations.
The fixed version is 148.0.3967.70, based on Chromium 148.0.7778.168.
Organizations should use enterprise software inventory tools to confirm that every Edge installation across their fleet has been updated to version 148.0.3967.70 or later.
Vendor Security History
Microsoft's Secure Future Initiative prioritizes security above all else and organizes engineering around six pillars meant to make products secure by design. Microsoft batches security fixes into coordinated releases, and the May 15, 2026 Edge Stable release fixed CVE-2026-45495 alongside at least two other Edge-specific vulnerabilities (CVE-2026-45494 and CVE-2026-45492). Microsoft rates this CVE "Exploitation More Likely" on its Exploitability Index, which means the vendor itself considers the flaw a credible near-term threat. That makes patching more urgent even though no exploitation has been observed.
References
- MSRC Security Update Guide: CVE-2026-45495
- CVE Record: CVE-2026-45495
- MITRE CVE API: CVE-2026-45495
- Microsoft Edge Security Release Notes
- Microsoft Edge Stable Channel Release Notes
- Microsoft Edge Update Policy Documentation
- Mondoo Vulnerability Intelligence: CVE-2026-45495
- HKCERT Security Alert (A26-05-32): Multiple Vulnerabilities in Microsoft Edge
- HKCert Security Bulletin: Microsoft Edge Multiple Vulnerabilities
- Microsoft Secure Future Initiative
- Microsoft Secure Future Initiative (SFI) Overview
