CVE-2026-77490 Microsoft Edge (Chromium-based) Spoofing Vulnerability

Api.Msrc.Microsoft • September 11, 2026

We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. You may change your selection by clicking “Manage Cookies” at the bottom of the page. Privacy Statement Third-Party Cookies

Released: Sep 11, 2026

Please see Common Vulnerability Scoring System for more information on the definition of these metrics.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

The following table provides an exploitability assessment for this vulnerability at the time of original publication.

According to the CVSS metrics, successful exploitation of this vulnerability could lead to some loss of confidentiality (C:L), and integrity (I:L) but lead to no loss of availability (A:N). What is the impact of this vulnerability?

An attacker who successfully exploited the vulnerability could view some sensitive information (Confidentiality), make changes to disclosed information (Integrity), but cannot limit access to the resource (Availability).

According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?

The vulnerability is in the web server, but the malicious scripts execute in the victim’s browser on their machine.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

This vulnerability requires that a user have multiple browser instances open of the affected version of Microsoft Edge (Chromium-based), one of which is a specially crafted website hosted by the attacker. The user would need to access the URL of the malicious website and then click a popup displayed on that site.

What is the version information for this release?

Orange Tsai (@orange_8361) with DEVCORE

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle .

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities in Microsoft Edge Chromium-based Browser Announced A series of vulnerabilities affecting Microsoft Edge (Chromium-based) have been disclosed, including CVE-2026-77490, a spoofing vulnerability, and several 'use after free' vulnerabilities (CVE-2026-87460, CVE-2026-87578, CVE-2026-87609, CVE-2026-87542, CVE-2026-87502, CVE-2026-87514, CVE-2026-87512, CVE-2026-87628, CVE-2026-87533, CVE-2026-87526, CVE-2026-87556, CVE-2026-87449, CVE-2026-87507, CVE-2026-87540, CVE-2026-87441, CVE-2026-87457, CVE-2026-87468, CVE-2026-87549, CVE-2026-87560, CVE-2026-87593, CVE-2026-87548, CVE-2026-87569, CVE-2026-87451, CVE-2026-87495). These vulnerabilities could lead to unauthorized access and information leakage. The vulnerabilities were published between September 9 and September 15, 2026, with some requiring user interaction for exploitation. Microsoft has released updates to mitigate these vulnerabilities, and users are urged to update their browsers immediately. 190 sources 61

Extracted Entities

CVE-2026-77490 Microsoft Edge (Chromium-based) Spoofing Vulnerability

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)