Improper privilege management in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally.
What kind of security feature could be bypassed by successfully exploiting this vulnerability? An authenticated local attacker can disable or enable Windows VBS without administrative privileges, resulting in bypass of platform security hardening. This does not grant direct code execution as another user but weakens system security guarantees, enabling follow‑on attacks. What is the version information for this release? Microsoft Edge Version Date Released Based on Chromium Version 144.0.3719.82 01/16/2026 144.0.7559.60 According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H) and integrity (I:H). What does that mean for this vulnerability? Virtualization-Based Security (VBS) safeguards credentials by isolating them within a secure environment. Disabling VBS reduces this isolation, compromising both confidentiality and integrity. It also weakens essential platform protections such as Credential Guard, Hypervisor-Protected Code Integrity (HVCI), and the Secure Kernel, resulting in a security feature bypass.
<a href="https://www.linkedin.com/in/alex-bernier-8a0515aa/">Alex Bernier</a> with <a href="https://crowdstrike.com/">CrowdStrike</a>