CVE-2026-85893 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Api.Msrc.Microsoft • September 15, 2026

We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. You may change your selection by clicking “Manage Cookies” at the bottom of the page. Privacy Statement Third-Party Cookies

Released: Sep 15, 2026

Please see Common Vulnerability Scoring System for more information on the definition of these metrics.

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

The following table provides an exploitability assessment for this vulnerability at the time of original publication.

What privileges could be gained by an attacker who successfully exploited the vulnerability?

An attacker could use this vulnerability to elevate privileges from a Low Integrity Level in a contained ("sandboxed") execution environment to a Medium Integrity Level. Please refer to AppContainer isolation and Mandatory Integrity Control for more information.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

The user must visit the attacker‑controlled webpage, and perform the two tap gestures that cause autofill to activate.

What is the version information for this release?

Nan Wang(@eternalsakura13) and Ziling Chen

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle .

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Disclosed for Microsoft Products with Privilege Escalation Risks On September 15, 2026, Microsoft disclosed several vulnerabilities affecting its products, including CVE-2026-55121, CVE-2026-62753, CVE-2026-62721, CVE-2026-49805, CVE-2026-61923, CVE-2026-50683, and CVE-2026-50688. These vulnerabilities include out-of-bounds reads, heap-based buffer overflows, and improper access controls, allowing attackers to elevate privileges to SYSTEM level. The vulnerabilities affect various Microsoft products, including Windows and Microsoft Office. Attack vectors include malicious Office files and specific protocol settings. The vulnerabilities have varying levels of attack complexity, with some requiring user interaction. Microsoft recommends applying security updates as soon as possible to mitigate risks. The CVEs have been assigned CVSS scores indicating potential impacts on confidentiality, integrity, and availability. 15 sources 59

Extracted Entities

CVE-2026-85893 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)