{"id":"CVE-2026-88078","kind":"vulnerability","aliases":["CVE-2026-88078"],"related":[],"title":"Microsoft Edge: weak signature check lets attackers spoof content over network","description":"Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.","summary":"Microsoft Edge (Chromium-based) does not properly verify a cryptographic signature. An unauthorized attacker on the network can perform spoofing.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chromium","microsoft-edge","runtime","windows"],"not_affected_if":[],"how_to_check":"- Check the installed Edge version under edge://settings/help","fix":null,"status":"open","published_at":"2026-10-29T16:19:53+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","triaged_at":"2026-10-29T16:31:57+00:00","updated_at":"2026-10-29T16:31:57+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-29T16:31:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Edge: weak signature check lets attackers spoof content over network","impact":"medium","summary":"Microsoft Edge (Chromium-based) does not properly verify a cryptographic signature. An unauthorized attacker on the network can perform spoofing.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["microsoft-edge","chromium","windows"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker spoofs content the browser should have rejected as unsigned.","analyst_note":"Confirm affected Edge versions and the fixed build from the Microsoft security update guide for CVE-2026-88078.","how_to_check":"- Check the installed Edge version under edge://settings/help\n- unknown","plain_action":"Update Microsoft Edge to the latest version from edge://settings/help.","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Users running Microsoft Edge (Chromium-based) builds affected by this flaw. The sources do not list affected version ranges or configuration details.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000627,"input_tokens":4082,"output_tokens":437,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-88078':14A,17A 'allow':56C 'attack':7A,38B,59C 'base':28B,55C 'check':5A 'chromium':18B,27B,54C 'chromium-bas':26B,53C 'content':9A 'cryptograph':34B,48C 'cve':12A,15A 'edg':2A,21B,25B,52C 'improp':45C 'let':6A 'microsoft':1A,20B,24B,51C 'microsoft-edg':19B 'network':11A,41B,65C 'perform':43B,61C 'proper':31B 'runtim':22B 'signatur':4A,35B,49C 'spoof':8A,44B,62C 'unauthor':37B,58C 'verif':46C 'verifi':32B 'weak':3A 'window':23B","nicknames":[],"mitigations":[],"who_affected":"Users running Microsoft Edge (Chromium-based) builds affected by this flaw. The sources do not list affected version ranges or configuration details.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Update Microsoft Edge to the latest version from edge://settings/help.","first_public_at":"2026-10-29T16:19:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88078","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88078","severity":null,"published_at":"2026-10-29T16:19:53+00:00","modified_at":"2026-10-29T16:19:53+00:00","first_seen_at":"2026-10-29T16:26:01+00:00","fetched_at":"2026-10-29T16:26:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}