CVE-2026-69486 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Api.Msrc.Microsoft • September 15, 2026

We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. You may change your selection by clicking “Manage Cookies” at the bottom of the page. Privacy Statement Third-Party Cookies

Released: Sep 15, 2026

Please see Common Vulnerability Scoring System for more information on the definition of these metrics.

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

The following table provides an exploitability assessment for this vulnerability at the time of original publication.

What is the version information for this release?

According to the CVSS metric, the attack vector is network (AV:N) and user interaction is required (UI:R). What is the target context of the remote code execution?

This attack requires a user to open a specially crafted file from the attacker to initiate remote code execution.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

An attacker must send a user a malicious Office file and convince them to open it.

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle .

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Discovered in Microsoft Products On September 15, 2026, Microsoft disclosed several vulnerabilities affecting its products, including CVE-2026-55053 and CVE-2026-68812, both related to heap-based buffer overflows in Microsoft Office Excel. These vulnerabilities allow unauthorized attackers to execute code locally, requiring user interaction to exploit. Additionally, CVE-2026-69486, a remote code execution vulnerability in Microsoft Edge (Chromium-based), was also published, enabling attackers to execute code over a network. The attack vector for Excel vulnerabilities is local, while Edge's vulnerability allows for network exploitation. Users are advised to be cautious when opening files from untrusted sources. All vulnerabilities were last updated on September 15, 2026, and patches are expected to be released shortly. 3 sources 57

Extracted Entities

CVE-2026-69486 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)