CVE-2026-88090: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Overview

Severity
Medium (CVSS 5.4)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C
Category
Elevation of Privilege
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2026-Oct
Released
2026-10-26
Last Updated
2026-10-26

Description

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

FAQ

According to the CVSS metrics, successful exploitation of this vulnerability could lead to some loss of confidentiality (C:L), and integrity (I:L) but lead to no loss of availability (A:N). What is the impact of this vulnerability? An attacker who successfully exploited the vulnerability could view some sensitive information (Confidentiality), make changes to disclosed information (Integrity), but cannot limit access to the resource (Availability). There are multiple update packages available for some of the affected software. Do I need to install all the updates listed in the Security Updates table for the software? Yes. Customers should apply all updates offered for the software installed on their systems. If multiple updates apply, they can be installed in any order.

Affected Products (1)

Browser

  • Microsoft Edge (Chromium-based)

Security Updates (1)

Acknowledgments

<a href="https://x.com/eternalsakura13">Nan Wang(@eternalsakura13) and Ziling Chen</a>

Revision History

  • 2026-10-26: Information published.
  • 2026-10-26: Added Edge software to the Security Updates table. Customers that are running supported version of Edge are encouraged to update to the indicated version to be protected from this vulnerability.