Critical Microsoft Edge Vulnerability Allows Remote Code Execution

Key Takeaways

• A critical vulnerability, CVE-2026-45495, in Microsoft Edge could allow remote code execution.
• The flaw stems from improper validation of feedback log file paths, potentially leading to unauthorized file operations.
• Exploitation requires user interaction, typically through visiting a malicious webpage or opening a crafted file.
• Microsoft has released security updates to address this and two other related vulnerabilities.

Critical Flaw in Microsoft Edge Poses Remote Code Execution Risk

Microsoft has issued an urgent security update for its Edge browser, addressing a critical vulnerability that could enable remote attackers to execute arbitrary code on affected systems. The flaw, identified as CVE-2026-45495, was reported by Orange Tsai of DEVCORE and carries a CVSS v3 score of 7.5, indicating a high severity.

Technical Details of the Vulnerability

The core issue lies in Edge’s handling of feedback log files. Specifically, the browser fails to adequately validate user-supplied file paths during file operations. This improper validation creates an opportunity for an attacker to manipulate file operations, directing them to unintended locations on the user’s system.

Exploitation of CVE-2026-45495 requires user interaction. An attacker would need to trick a user into either visiting a specially crafted malicious webpage or opening a malicious file. If successful, this vulnerability could be chained with other bugs to execute code within the context of the logged-in user.

Given that the exploit operates with the privileges of the current user, the potential impact is significant. This could range from unauthorized data theft and compromise of the browser profile to establishing local persistence or facilitating lateral movement within a network if higher privileges are present on the system.

While Microsoft has not released exploit code, the characteristics of the vulnerability—path manipulation during file access combined with the need for user interaction—suggest that social engineering tactics would be the likely delivery mechanisms. This includes malicious attachments, drive-by download pages, or poisoned downloads.

Additional Edge Vulnerabilities Patched

In addition to the critical remote code execution flaw, Microsoft’s coordinated update addresses two other vulnerabilities in Edge, also discovered by the same research group:

• CVE-2026-45494 (CVSS 5.0): This is a navigation-handling weakness that could lead to cross-origin script injection, also requiring user interaction for exploitation.
• CVE-2026-45492 (CVSS 4.3): This flaw involves insufficient origin validation in cross-device managed sign-in, which could expose restricted functionality and be combined with other issues for greater impact.

The vulnerabilities were initially reported to Microsoft on May 20, 2026, with public advisories and updates released on June 4, 2026. Credit for these discoveries goes to Orange Tsai (@orange_8361) of the DEVCORE Research Team (@d3vc0r3).

What You Should Do

• Immediately update Microsoft Edge to the latest stable release. This can typically be done through Microsoft Update or by navigating to the “About Microsoft Edge” page within the browser settings.
• Ensure your operating system is also fully patched, applying any updates prompted by Microsoft Update.
• Exercise extreme caution when encountering untrusted attachments or links in emails, messaging applications, or on unfamiliar websites.
• Utilize least-privilege user accounts for daily browsing and administrative tasks to minimize the potential impact of any successful exploitation.
• Organizations should monitor endpoint detection and response (EDR) systems for any unusual file operations or new persistence mechanisms associated with browser processes.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.