CVE-2026-96203: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Overview

Severity
High (CVSS 8.8)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Category
Elevation of Privilege
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2026-Oct
Released
2026-10-26

Description

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

FAQ

What privileges could be gained by an attacker who successfully exploited the vulnerability? An attacker could use this vulnerability to elevate privileges from a Low Integrity Level in a contained ("sandboxed") execution environment to a Medium Integrity Level or a High Integrity Level. Please refer to AppContainer isolation and Mandatory Integrity Control for more information. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? The user must visit the attacker‑controlled webpage, and perform the two tap gestures that cause autofill to activate.

Affected Products (1)

Browser

  • Microsoft Edge (Chromium-based)

Security Updates (1)

Acknowledgments

<a href="https://x.com/eternalsakura13">Nan Wang(@eternalsakura13) and Ziling Chen</a>, 0AF3B0CB6FEFDED70267D4510DF654D8

Revision History

  • 2026-10-26: Information published.