MSRC-CVE-2026-66324 — Microsoft Edge (Chromium-based) Spoofing Vulnerability

Summary

Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

Details

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
The user must visit the attacker‑controlled webpage, and perform the two tap gestures that cause autofill to activate.

What is the version information for this release?
152.0.4191.53: 152.0.4191.53, 08/28/2026: 08/28/2026, 152.0.7977.64/.65: 152.0.7977.64/.65

Security updates
152.0.4191.52 — https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security

Vulnerabilities 1

Medium 6.5

CVE-2026-66324

Microsoft Edge (Chromium-based) Spoofing Vulnerability

External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

Microsoft Microsoft Edge (Chromium-based) Microsoft Edge for Android Microsoft Edge for iOS Linux Windows Android iOS Browsers

Aug 28, 2026

Revision history

2026-08-28 #1
Information published.

References

CVE-2026-66324 Microsoft Edge (Chromium-based) Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66324
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss