Microsoft Edge Fixes Elevation of Privilege Vulnerability CVE-2026-42838

Microsoft disclosed CVE-2026-42838, an elevation of privilege flaw in Chromium-based Microsoft Edge caused by improper neutralization of special elements in output used by a downstream component (CWE-74). The company rated the issue Moderate with a CVSS 3.1 score of 5.4, stating that exploitation requires user interaction, can be launched over the network with low attack complexity, and would give an attacker the same rights as the user running the browser. Microsoft said the vulnerability was not publicly disclosed, not exploited in the wild, and less likely to be exploited at the time of publication.

A fix was released in Microsoft Edge version 148.0.3967.55, based on Chromium 148.0.7778.97. The disclosure follows a long pattern of Microsoft Edge privilege-escalation advisories, including earlier CVEs such as CVE-2022-26895, CVE-2022-23262, CVE-2022-26908, CVE-2022-26894, CVE-2022-26900, CVE-2022-44708, CVE-2022-21954, CVE-2022-21970, CVE-2021-34475, CVE-2022-33680, and CVE-2022-26909, underscoring the recurring need to keep Edge updated to the latest security release.