SB2026081746 - Remote code execution in Microsoft Edge

Description

This security bulletin contains information about 1 vulnerability.

1) Heap-based buffer overflow (CVE-ID: CVE-2026-72970)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in Microsoft Edge (Chromium-based) when rendering an attacker-controlled webpage and activating autofill. A remote attacker can trick the victim into visiting a crafted webpage and performing the required gestures to execute arbitrary code.

User interaction is required: the victim must visit an attacker-controlled webpage and perform two tap gestures that cause autofill to activate.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-72970
• https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security