Multiple Vulnerabilities in Microsoft Edge Expose Users to Risks

www.sentinelone.com

Multiple Vulnerabilities in Microsoft Edge Expose Users to Risks

First seen 16 Sep 2026, 17:33 UTC • •72.0

Article Content

1 / 4

Browse articles

ThreatCluster •September 17, 2026 at 17:29 UTC

•CVE-2026-55945 allows local attackers to disclose sensitive information.
•CVE-2026-87491 is actively exploited, enabling remote code execution.
•Microsoft Edge versions prior to 153.0.4234.32 are vulnerable.

Two vulnerabilities, CVE-2026-55945 and CVE-2026-87491, have been identified in Microsoft Edge. CVE-2026-55945 is a race condition vulnerability that allows authorized local attackers to disclose sensitive information, affecting all versions prior to the fixed release. CVE-2026-87491, which is actively being exploited, allows remote attackers to execute arbitrary code via a crafted HTML page, posing an extremely high risk. Microsoft Edge versions prior to 153.0.4234.32 are affected by this critical flaw. The vulnerabilities were published on July 3, 2026, and September 9, 2026, respectively. Microsoft has issued advisories and patches to mitigate these risks. Security professionals are urged to apply the latest updates immediately to protect their systems.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 45d ago How this analysis works

Timeline

2026-07-03

CVE-2026-55945 published

A race condition vulnerability in Microsoft Edge disclosed, allowing local information disclosure.

2026-09-09

CVE-2026-87491 published

A critical remote code execution vulnerability in Microsoft Edge disclosed, actively exploited in the wild.

2026-09-09

CVE-2026-87491 added to CISA KEV

CISA added CVE-2026-87491 to the Known Exploited Vulnerabilities catalog due to active exploitation.

More articles in this cluster (3)

Threat Graph

8 entities, 7 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Data Breach
Zero-day Exploit

Vulnerability (2)

CVE-2026-55945
CVE-2026-87491

Weakness (3)

CWE-200 - Exposure of Sensitive Information
CWE-269 - Improper Privilege Management
CWE-362 - Race Condition

Affected Platform (1)

Microsoft Edge

Relationships

CVE-2026-55945 targets Microsoft Edge
CVE-2026-87491 targets Microsoft Edge
Data Breach targets Microsoft Edge
Zero-day Exploit targets Microsoft Edge
CVE-2026-55945 related to CWE-200 - Exposure of Sensitive Information
CVE-2026-55945 related to CWE-269 - Improper Privilege Management
CVE-2026-55945 related to CWE-362 - Race Condition

Following this threat?

Track CVE-2026-55945 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical RCE Vulnerability in Prefab UI Disclosed A critical remote code execution vulnerability, CVE-2026-120338, was disclosed on November 1, 2026, affecting Prefab UI's Generative UI sandbox. The flaw allows attackers to execute arbitrary Python code by exploiting Deno's permissions, enabling file read/write access on the host server. This vulnerability affects…

Chinese Actor Compromises US Government Networks via PHP2Shell Exploit A suspected Chinese nation-state actor exploited vulnerabilities in Palo Alto Networks firewalls using a chained PHP2Shell exploit and a Linux kernel privilege escalation flaw. The attack, which began on October 23, targeted 25 servers across the US, Japan, Taiwan, and South Korea, with a focus on US…