CVE-2026-45492: Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Medium severity · published May 18, 2026

CVE-2026-45492

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

5.4

CVSS

0.3%

EPSS

On KEV

Description

Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 23% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Microsoft Edge (Chromium-based) · Microsoft

1.0.0.0 before 148.0.3967.70 · source: vendor

Edge Chromium · Microsoft

before 148.0.3967.70 · source: NVD

In the news

VulnerabilityLow

ZDI-26-329: (Pwn2Own) Microsoft Edge Origin Validation Error Security Bypass Vulnerability

This vulnerability allows remote attackers to access restricted functionality on affected installations of Microsoft Edge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 4.3. The following CVEs are assigned: CVE-2026-45492.

CVE-2026-45492

Jun 4, 2026·Zero Day Initiative

Affected product

Microsoft Edge (Chromium-based)

Microsoft

All Microsoft Edge (Chromium-based) CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-45492

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-45492

Vendor Advisory