Incorrect authorization in Microsoft Edge - CVE-2026-120930
Published: November 11, 2026
Vulnerability identifier: #VU165423
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-120930
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authorization checks and potentially access or modify information without permission.
The vulnerability exists due to incorrect authorization in Chromium as used by Microsoft Edge when evaluating access to protected resources. A remote attacker can induce a user to interact with attacker-controlled content to potentially obtain unauthorized access to information or make unauthorized changes.
Affected software
Microsoft Edge
How to mitigate CVE-2026-120930
Install security update from vendor's website.
Microsoft Edge - update to 157.0.4341.42