{"id":"CVE-2026-85899","kind":"vulnerability","aliases":["CVE-2026-85899"],"related":[],"title":"Microsoft Edge: use-after-free lets an authorized user gain higher privileges","description":"Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network.","summary":"Use-after-free in Microsoft Edge (Chromium-based) lets an attacker who already runs code in Edge's sandbox (Low integrity) escape to Medium or High integrity. Microsoft rates it Important (CVSS 8.1), not exploited and not publicly disclosed, and fixed in 155.0.4283.45.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Edge (Chromium-based)","fixed":["155.0.4283.45"],"affected":"< 155.0.4283.45","ecosystem":"vendor"}],"ecosystems":[],"tags":["browser","chromium","microsoft-edge","other","sandbox-escape","windows"],"not_affected_if":[],"how_to_check":"Open edge://settings/help (or Edge menu > Help and feedback > About Microsoft Edge); versions below 155.0.4283.45 are affected. Fleet: Get-Item 'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' | % VersionInfo.","fix":"Update Microsoft Edge (Chromium-based) to 155.0.4283.45 or later (edge://settings/help).","status":"open","published_at":"2026-10-29T16:19:45+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","triaged_at":"2026-10-29T16:29:34+00:00","updated_at":"2026-10-29T16:34:56+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-29T16:29:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Edge: use-after-free lets an authorized user gain higher privileges","impact":"high","summary":"A use-after-free memory bug in Microsoft Edge (Chromium-based) can be abused by an attacker who already has authorized access to raise their privileges over a network. The sources do not describe the exact trigger or the scope of the elevated access.","audience":"everyone","category":"other","nicknames":[],"who_cares":["microsoft-edge","chromium","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker with some access gains elevated privileges over the network","analyst_note":"Confirm affected Edge versions and fixed build from Microsoft's CVE-2026-85899 advisory; NVD entry alone lacks ranges.","how_to_check":"- Check the installed Edge version (Edge menu > Help and feedback > About Microsoft Edge), since the sources do not list affected version ranges.\n- unknown","plain_action":"Update Microsoft Edge to the latest version (Settings > About Microsoft Edge) once Microsoft's fixed build is confirmed.","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations and individuals running Microsoft Edge (Chromium-based) are potentially affected; the sources only describe an authorized attacker over a network. unknown for configuration or role specifics.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000676,"input_tokens":4068,"output_tokens":538,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Edge versions and fixed build from Microsoft's CVE-2026-85899 advisory; NVD entry alone lacks ranges.","search":"'-2026':15A,18A '-85899':16A,19A '155.0.4283.45':79B '8.1':69B 'allow':89C 'alreadi':49B 'attack':47B,92C 'author':9A,91C 'base':44B,88C 'based':24A 'browser':25B 'chromium':23A,26B,43B,87C 'chromium-bas':42B,86C 'chromium-based':22A 'code':51B 'cve':14A,17A 'cvss':68B 'disclos':75B 'edg':2A,29B,41B,53B,85C 'edge':21A 'elev':94C 'escap':33B,58B 'exploit':71B 'fix':77B 'free':6A,38B,82C 'gain':11A 'high':62B 'higher':12A 'import':67B 'integr':57B,63B 'let':7A,45B 'low':56B 'medium':60B 'microsoft':1A,20A,28B,40B,64B,84C 'microsoft-edg':27B 'network':98C 'privileg':13A,95C 'public':74B 'rate':65B 'run':50B 'sandbox':32B,55B 'sandbox-escap':31B 'use':4A,36B,80C 'use-after-fre':3A,35B 'user':10A 'window':34B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Microsoft Edge (Chromium-based) older than 155.0.4283.45 on Windows desktops or managed fleets. It matters most as the second stage of a browser exploit chain, where code in the sandbox escapes it. Machines already on 155.0.4283.45 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-29T16:34:56Z","by":"analyst","doc":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85899","run_id":1066},"products":{"at":"2026-10-29T16:34:56Z","by":"analyst","doc":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85899","run_id":1066},"how_to_check":{"at":"2026-10-29T16:34:56Z","by":"analyst","doc":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85899","run_id":1066}},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Microsoft Edge to the latest version: Edge menu > Help and feedback > About Microsoft Edge, then restart the browser.","first_public_at":"2026-10-29T16:19:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85899","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85899","severity":null,"published_at":"2026-10-29T16:19:45+00:00","modified_at":"2026-10-29T16:19:45+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","fetched_at":"2026-10-29T16:26:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-85899:1066","url":null,"severity":null,"published_at":"2026-10-29T16:34:56+00:00","modified_at":"2026-10-29T16:34:56+00:00","first_seen_at":"2026-10-29T16:34:56+00:00","fetched_at":"2026-10-29T16:34:56+00:00","note":"Read MSRC advisory: fixed in Edge 155.0.4283.45 (released Oct 26 2026); not exploited, not publicly disclosed, 'Exploitation Unlikely'. OffSeq's 'public exploit' claim is just the CVSS E:P temporal metric, ignored. Sandbox-escape style EoP (Low IL to Medium/High IL)."}],"documents":[{"id":17785,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85899","title":"MSRC: CVE-2026-85899 Microsoft Edge (Chromium-based) Elevation of Privilege","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}