Multiple security vulnerabilities have been identified in Microsoft Edge, affecting the browser's handling of sign-in navigation, popup controls, cross-origin data exposure, and script execution restrictions. The flaws can be chained so that a malicious web page can execute JavaScript across sites and ultimately run code outside the browser sandbox on Windows. The overall risk is high for affected deployments, because the chain can lead to full compromise of the user's session and machine.
CVE-2026-45492 (CVSS 5.4 — Medium): This is a security feature bypass in Microsoft Edge's conditional access navigation throttle handling. A malicious web page can trigger the feature so the browser starts a navigation that is not tied to the requesting page, enabling cross-site script execution.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Microsoft Edge, affecting the browser's handling of sign-in navigation, popup controls, cross-origin data exposure, and script execution restrictions. The flaws can be chained so that a malicious web page can execute JavaScript across sites and ultimately run code outside the browser sandbox on Windows. The overall risk is high for affected deployments, because the chain can lead to full compromise of the user's session and machine.
CVE-2026-45492 (CVSS 5.4 — Medium): This is a security feature bypass in Microsoft Edge's conditional access navigation throttle handling. A malicious web page can trigger the feature so the browser starts a navigation that is not tied to the requesting page, enabling cross-site script execution.[emaillocker id="1283"]
CVE-2026-45494 (CVSS 5.4 — Medium): This is a spoofing flaw in Microsoft Edge's handling of trusted-site or popup validation. A remote attacker can bypass the intended check by opening a request from a second window, allowing the malicious flow to proceed.
CVE-2026-45495: The flaw allows remote attackers to execute arbitrary code on affected installations of Microsoft Edge, potentially compromising the browser environment.
These vulnerabilities collectively present a high-risk browser-based attack path that can move from a malicious web page to code execution outside the sandbox. Users and organizations running affected Microsoft Edge deployments are most at risk, particularly where sign-in flows and web content are used together. The general action is to treat these flaws as a serious browser compromise risk and manage exposure of affected deployments.
We recommend you to update Microsoft Edge to version 148.0.3967.70.
The following reports contain further technical details:
[/emaillocker]