Loading vulnerability…
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2026-42838 is an elevation of privilege vulnerability in Microsoft Edge (Chromium-based) caused by improper neutralization of special elements in output used by a downstream component. The flaw is classified as CWE-74 and is reachable over the network. Microsoft rated it Moderate severity with CVSS v3.1 5.4. The available information indicates that exploitation requires user interaction and no prior privileges, and that successful exploitation grants the attacker the rights of the user running the affected Edge process.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an unauthorized attacker to elevate privileges to the level of the user running Microsoft Edge. The documented security impact is limited confidentiality and integrity compromise: an attacker may be able to view some sensitive information and make changes to information accessible in that user context. No availability impact has been reported.
If you can’t patch tonight, do this now.
Apply the latest Microsoft Edge security updates from Microsoft. Where immediate patching is not possible, reduce exposure by limiting user interaction with untrusted web content and operating the browser with the least-privileged user context practical, since successful exploitation yields the rights of the current user.
Patch, then assume compromise.
Upgrade Microsoft Edge (Chromium-based) to a version containing Microsoft's fix. The published remediation is Microsoft Edge version 148.0.3967.55 or later, released on 2026-05-11 and based on Chromium 148.0.7778.97.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.