Multiple Vulnerabilities in Microsoft Edge Expose Users to Risks

www.sentinelone.com

Multiple Vulnerabilities in Microsoft Edge Expose Users to Risks

First seen 16 Sep 2026, 17:33 UTC • •72.0

Article Content

1 / 4

Browse articles

ThreatCluster •September 16, 2026 at 18:53 UTC

•CVE-2026-55945 allows local attackers to disclose sensitive information.
•CVE-2026-87491 is actively exploited, enabling remote code execution.
•Microsoft Edge versions prior to 153.0.4234.32 are vulnerable.

Two vulnerabilities, CVE-2026-55945 and CVE-2026-87491, have been identified in Microsoft Edge. CVE-2026-55945 is a race condition vulnerability that allows authorized local attackers to disclose sensitive information, affecting all versions prior to the fixed release. CVE-2026-87491, which is actively being exploited, allows remote attackers to execute arbitrary code via a crafted HTML page, posing an extremely high risk. Microsoft Edge versions prior to 153.0.4234.32 are affected by this critical flaw. The vulnerabilities were published on July 3, 2026, and September 9, 2026, respectively. Microsoft has issued advisories and patches to mitigate these risks. Security professionals are urged to apply the latest updates immediately to protect their systems.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-07-03

CVE-2026-55945 published

A race condition vulnerability in Microsoft Edge disclosed, allowing local information disclosure.

2026-09-09

CVE-2026-87491 published

A critical remote code execution vulnerability in Microsoft Edge disclosed, actively exploited in the wild.

2026-09-09

CVE-2026-87491 added to CISA KEV

CISA added CVE-2026-87491 to the Known Exploited Vulnerabilities catalog due to active exploitation.

More articles in this cluster (3)

Threat Graph

9 entities, 11 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Data Breach
Zero-day Exploit

Vulnerability (2)

CVE-2026-55945
CVE-2026-87491

Weakness (3)

CWE-200 - Exposure of Sensitive Information
CWE-269 - Improper Privilege Management
Cwe-362 - Race Condition

Affected Platform (2)

Microsoft Edge
Windows

Relationships

CVE-2026-55945 targets Microsoft Edge
CVE-2026-55945 targets Windows
CVE-2026-87491 targets Microsoft Edge
CVE-2026-87491 targets Windows
Data Breach targets Microsoft Edge
Data Breach targets Windows
Zero-day Exploit targets Microsoft Edge
Zero-day Exploit targets Windows
CVE-2026-55945 related to CWE-200 - Exposure of Sensitive Information
CVE-2026-55945 related to CWE-269 - Improper Privilege Management
CVE-2026-55945 related to Cwe-362 - Race Condition

Following this threat?

Track CVE-2026-55945 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

BragJack Attack Compromises Major Browser AI Assistants The BragJack attack exploits vulnerabilities in the AI assistants of five major browsers: Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome. Researchers from Forever Security discovered that these vulnerabilities allow attackers to access sensitive data, control local files, and…

Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and…