PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45492 Microsoft CVE debrief

CVE-2026-45492 is a medium-severity vulnerability in Microsoft Edge (Chromium-based) resulting from improper input validation (CWE-20). An unauthenticated attacker can exploit this flaw over a network to bypass a security feature. The vulnerability was published on May 18, 2026, and last modified on May 19, 2026. Microsoft has issued a vendor advisory addressing this issue. Affected versions are those prior to 148.0.3967.70. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and low impacts to confidentiality and integrity with no availability impact.

Vendor
Microsoft
Product
Microsoft Edge (Chromium-based)
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-18
Original CVE updated
2026-05-19
Advisory published
2026-05-18
Advisory updated
2026-05-19

Who should care

Organizations and individuals using Microsoft Edge (Chromium-based) versions prior to 148.0.3967.70 should prioritize patching. Security teams responsible for browser security, endpoint protection, and patch management should assess exposure and deploy updates. System administrators managing enterprise browser deployments should verify update compliance across their environments.

Technical summary

This vulnerability stems from insufficient validation of input data in Microsoft Edge's Chromium-based implementation. The flaw enables network-based attackers to circumvent intended security controls without authentication, though user interaction is required. The attack complexity is low, and successful exploitation can result in limited confidentiality and integrity impacts. The vulnerability does not affect system availability.

Defensive priority

medium

Recommended defensive actions

  • Update Microsoft Edge (Chromium-based) to version 148.0.3967.70 or later to remediate this vulnerability.
  • Review and apply security updates through standard Microsoft update channels.
  • Monitor for anomalous network activity that may indicate attempted exploitation of input validation weaknesses.
  • Consider implementing defense-in-depth controls such as network segmentation and application allowlisting to reduce attack surface.

Evidence notes

The vulnerability is classified under CWE-20 (Improper Input Validation) per Microsoft's primary source, though NVD also records it as NVD-CWE-noinfo. The affected product is Microsoft Edge Chromium with versions before 148.0.3967.70 being vulnerable. The CVSS score of 5.4 reflects medium severity with network-based attack requirements and user interaction needed for exploitation.

Official resources

Microsoft disclosed this vulnerability through its Security Response Center (MSRC) and it was subsequently cataloged in the National Vulnerability Database. The issue was identified as improper input validation allowing security feature绕过.