Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation More Likely. Customer action: Required.
Details
According to the CVSS metric, the attack vector is network (AV:N) and the attack complexity is low (AC:L). What does that mean for this vulnerability?
The attack vector is Network (AV:N) because this vulnerability is remotely exploitable and can be exploited from the internet. The attack complexity is Low (AC:L) because an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component.
What is the version information for this release?
148.0.3967.70: 148.0.3967.70, 05/15/2026: 05/15/2026, 148.0.7778.168: 148.0.7778.168
Security updates
148.0.3967.70 — https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security
Vulnerabilities 1
-
High 8.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Revision history
-
#3
Acknowledgement added. This is an informational change only.
-
#2
CWE added. Informational change only.
-
#1
Information published.
References
-
CVE-2026-45495 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45495
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss