{"id":"CVE-2026-96199","kind":"vulnerability","aliases":["CVE-2026-96199"],"related":[],"title":"Microsoft Edge: heap buffer overflow lets a remote attacker run code","description":"Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.","summary":"Heap buffer overflow (CWE-122) in Chromium-based Microsoft Edge. A malicious web page can run code once the user visits it (CVSS 8.8, user interaction required). Fixed in the Oct 16 2026 Stable release per Tenable; no known exploitation or public PoC.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Edge (Chromium-based)","fixed":["155.0.4283.62"],"affected":"< 155.0.4283.62","ecosystem":"vendor"}],"ecosystems":[],"tags":["browser","chromium","microsoft-edge","other","windows"],"not_affected_if":["fully-updated-edge"],"how_to_check":"Open edge://settings/help. Edge updates itself and shows the version. If it is below 155.0.4283.62, update and restart the browser.","fix":"Update Microsoft Edge (Stable, desktop) to 155.0.4283.62 or later; 156.0.4314.42 is current as of Oct 22. Unconfirmed against the MSRC page.","status":"open","published_at":"2026-10-29T16:20:08+00:00","first_seen_at":"2026-10-29T16:26:04+00:00","triaged_at":"2026-10-29T16:27:53+00:00","updated_at":"2026-10-29T16:33:41+00:00","category":"other","confidence":0.55,"triage":{"at":"2026-10-29T16:27:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Microsoft Edge: heap buffer overflow lets a remote attacker run code","impact":"high","summary":"A heap-based buffer overflow in Chromium-based Microsoft Edge lets an unauthorized attacker run code over the network. The NVD entry gives a CVSS score of 8.8 and no further detail.","audience":"everyone","category":"other","nicknames":[],"who_cares":["microsoft-edge","chromium","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs code on the machine over the network","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-96199 for affected versions, fixed build and whether user interaction is required.","how_to_check":"- Check the installed Edge version, for example in edge://settings/help, and compare it with the fixed version in the vendor's advisory\n- unknown: the sources do not name affected version ranges","plain_action":"Update Microsoft Edge to the latest version through its built-in update check.","needs_analyst":true,"not_affected_if":["fully-updated-edge"],"who_is_affected":"Anyone running a Chromium-based Microsoft Edge build that has not received the vendor fix. The sources do not describe the exact code path or required user interaction. unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000661,"input_tokens":4080,"output_tokens":506,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-96199 for affected versions, fixed build and whether user interaction is required.","search":"'-122':34B '-2026':13A,16A '-96199':14A,17A '16':62B '2026':63B '8.8':54B 'allow':85C 'attack':9A,88C 'base':38B,76C,84C 'based':22A 'browser':23B 'buffer':4A,31B,77C 'chromium':21A,24B,37B,83C 'chromium-bas':36B,82C 'chromium-based':20A 'code':11A,47B,91C 'cve':12A,15A 'cvss':53B 'cwe':33B 'edg':2A,27B,40B,81C 'edge':19A 'execut':90C 'exploit':70B 'fix':58B 'heap':3A,30B,75C 'heap-bas':74C 'interact':56B 'known':69B 'let':6A 'malici':42B 'microsoft':1A,18A,26B,39B,80C 'microsoft-edg':25B 'network':94C 'oct':61B 'overflow':5A,32B,78C 'page':44B 'per':66B 'poc':73B 'public':72B 'releas':65B 'remot':8A 'requir':57B 'run':10A,46B 'stabl':64B 'tenabl':67B 'unauthor':87C 'user':50B,55B 'visit':51B 'web':43B 'window':29B","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Chromium-based Microsoft Edge build that has not received the vendor fix. The sources do not describe the exact code path or required user interaction. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Update Microsoft Edge: open the menu, then Settings > About Microsoft Edge, let it update, and restart the browser.","first_public_at":"2026-10-29T16:20:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96199","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96199","severity":null,"published_at":"2026-10-29T16:20:08+00:00","modified_at":"2026-10-29T16:20:08+00:00","first_seen_at":"2026-10-29T16:26:04+00:00","fetched_at":"2026-10-29T16:26:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96199:1061","url":null,"severity":null,"published_at":"2026-10-29T16:33:41+00:00","modified_at":"2026-10-29T16:33:41+00:00","first_seen_at":"2026-10-29T16:33:41+00:00","fetched_at":"2026-10-29T16:33:41+00:00","note":"MSRC page is JS-only and returned no content, so nothing verified. Tenable (via Vulners) lists Edge < 155.0.4283.62 as affected, and the Edge release notes show 155.0.4283.62 shipped Oct 16 2026, the CVE publish date. 156.0.4314.42 (Oct 22) is newer. Not confirmed on the vendor page that this CVE is in 155.0.4283.62. Feedly says user interaction required (CVSS UI:R), no known exploitation, no public PoC. Edge for Android has its own build (155.0.4283.61)."}],"documents":[{"id":17760,"url":"https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security","title":"Microsoft Edge security release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":17761,"url":"https://vulners.com/mscve/MS:CVE-2026-96199","title":"Vulners mirror of MSRC CVE-2026-96199 (lists Tenable Edge < 155.0.4283.62)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}