Authentication bypass using an alternate path or channel in Microsoft Edge - CVE-2026-57980

Detailed vulnerability description

The vulnerability allows a remote attacker to perform tampering.

The vulnerability exists due to authentication bypass using an alternate path or channel in Microsoft Edge (Chromium-based) when handling attacker-controlled web content. A remote attacker can host a specially crafted website and convince a user to visit it to perform tampering.

User interaction is required, and the user must visit the attacker-controlled webpage and perform two tap gestures that cause autofill to activate.

How to mitigate CVE-2026-57980

Sources

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-57980
• https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security