CVE-2026-62904: CWE-863: Incorrect Authorization in Microsoft Microsoft Edge (Chromium-based)

This vulnerability, identified as CWE-863 (Incorrect Authorization), exists in Microsoft Edge (Chromium-based). It allows an attacker without proper authorization to disclose information over a network. The affected versions are all releases starting from 1.0.0.0 up to but excluding 152.0.4191.52. The CVSS 3.1 vector indicates the attack vector is network-based with low attack complexity, no privileges required, but user interaction is needed. The impact includes limited confidentiality and integrity loss without availability impact. Microsoft has published an official fix for this vulnerability.

An unauthorized attacker can exploit this vulnerability to disclose information over a network, potentially leading to limited confidentiality and integrity impacts. There is no impact on availability. The vulnerability does not require privileges but does require user interaction.

An official fix is available from Microsoft. Users and administrators should apply the security update for Microsoft Edge (Chromium-based) version 152.0.4191.52 or later to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62904 for detailed patch information and update instructions.