Live › vulnerability › CVE-2026-96196
Microsoft Edge (Chromium-based) has an incomplete list of disallowed inputs (CWE-184) that lets a network attacker bypass a security feature once a user opens attacker-controlled content. MSRC says the bypassed safeguard is the path validation that checks which files may be changed and asks for approval for sensitive locations. Fixed in Edge 156.0.4314.42.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Anyone running Microsoft Edge (Chromium-based) older than 156.0.4314.42, on any desktop platform. Exploitation needs the user to open or load attacker-controlled content, so machines where people browse the web or open files from outside are the ones to patch first. Servers with no Edge installed can skip it; Edge normally auto-updates.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Microsoft Edge (Chromium-based) | vendor | < 156.0.4314.42 | 156.0.4314.42 |
Open edge://settings/help and confirm Edge is 156.0.4314.42 or later; anything older on the 156 line is exposed.
Update Microsoft Edge (Chromium-based) to 156.0.4314.42 or later (edge://settings/help, or your managed Edge update channel).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
This page as .md · .json · in your agent: get_signal("CVE-2026-96196")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.