CVE-2026-55945

CVE-2026-55945 is a race condition vulnerability in Microsoft Edge Chromium that enables authorized attackers to disclose information locally. This article covers the technical details, affected versions, impact, and mitigation.

Published : July 9, 2026

CVE-2026-55945 Overview

CVE-2026-55945 is a race condition vulnerability in Microsoft Edge (Chromium-based) that allows an authorized local attacker to disclose information. The flaw stems from concurrent execution using a shared resource with improper synchronization, categorized under [CWE-362]. Exploitation requires local access, low privileges, and high attack complexity, resulting in limited confidentiality and integrity impact with a scope change.

The vulnerability affects Microsoft Edge Chromium and was published to the National Vulnerability Database (NVD) on July 3, 2026. Microsoft has issued a security advisory through the Microsoft Security Response Center (MSRC) update guide.

Critical Impact Authorized local attackers can win a timing race to read information that crosses a security boundary, potentially disclosing sensitive browser data across origins or process contexts.

Authorized local attackers can win a timing race to read information that crosses a security boundary, potentially disclosing sensitive browser data across origins or process contexts.

Microsoft Edge (Chromium-based) — all versions prior to the fixed release

Windows platforms running vulnerable Edge builds

Enterprise deployments using Edge as the managed browser

2026-07-03 - CVE-2026-55945 published to NVD

2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-55945

Vulnerability Analysis

The vulnerability is a race condition ([CWE-362]) in Microsoft Edge (Chromium-based). Multiple concurrent execution paths access a shared resource without adequate synchronization primitives. When an attacker times operations precisely, the browser exposes state that should remain isolated. The scope change indicated in the vector reflects that a successful exploit affects resources beyond the vulnerable component, such as content managed by another origin or renderer context.

The attack complexity is high because the attacker must reliably win a narrow timing window. The impact is bounded to partial confidentiality and integrity disclosure, with no availability impact. Successful exploitation does not grant code execution but can leak information useful for follow-on attacks such as session token theft, cross-origin data reads, or credential harvesting.

The root cause is improper synchronization on a shared resource accessed by concurrent threads or processes within the Edge Chromium codebase. Without proper locking, ordering guarantees, or atomic operations, one execution path observes an inconsistent intermediate state written by another. Microsoft has not disclosed the specific component. Refer to the Microsoft Security Update CVE-2026-55945 advisory for authoritative technical details.

An authorized local attacker executes code on the same system where Edge runs. The attacker triggers concurrent browser operations designed to race a target resource. Winning the race causes Edge to expose data across a trust boundary. Because user interaction is not required and the attacker already has local low-privileged access, the vulnerability is most relevant on multi-user systems, shared workstations, and Virtual Desktop Infrastructure (VDI) hosts.

No public proof-of-concept exploit is available at this time, and the vulnerability is not listed in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog. The Exploit Prediction Scoring System (EPSS) score is 0.145%.

Detection Methods for CVE-2026-55945

Indicators of Compromise

Unexpected Edge child processes spawned by low-privileged local users on shared or terminal-services hosts

Anomalous inter-process access patterns targeting Edge renderer or utility processes

Repeated, rapid launches of Edge with unusual command-line flags aimed at forcing concurrent operations

Inventory Edge Chromium versions across the environment and flag any endpoints not on the patched build

Monitor process telemetry for local user accounts interacting programmatically with msedge.exe and its subprocesses

Alert on scripts or binaries launched from user-writable directories that invoke Edge in headless or automation modes

Monitoring Recommendations

Collect endpoint process and command-line telemetry into a centralized data lake for retrospective hunting

Track browser update compliance as a security key performance indicator (KPI) and alert on drift

Correlate local logon events with subsequent Edge automation activity to surface reconnaissance behavior

How to Mitigate CVE-2026-55945

Immediate Actions Required

Update Microsoft Edge (Chromium-based) to the fixed version referenced in the Microsoft Security Update CVE-2026-55945 advisory

Verify Edge auto-update is enabled through group policy or Microsoft Intune on all managed endpoints

Restrict interactive local logon rights on shared systems to reduce the population of authorized attackers

Microsoft has published patch guidance in the MSRC update guide. Administrators should confirm the deployed Edge Stable channel version matches or exceeds the fixed build listed in the advisory. Enterprise deployments using the Microsoft Edge Update service should validate that update rings are not paused. Refer to the Microsoft Security Update CVE-2026-55945 advisory for exact version numbers.

Enforce least-privilege on multi-user hosts to limit which accounts can execute local code alongside Edge

Apply application control policies to block unauthorized binaries from launching Edge with automation flags

Isolate high-value browsing sessions on dedicated hosts where untrusted local users cannot execute code

Disclaimer : This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.