Microsoft Edge (Chromium) Elevation of Privilege Vulnerability (CVE‑2026‑69446) – Immediate Update Required

What happened

Microsoft Edge (Chromium‑based) suffered a severe local privilege‑escalation vulnerability, identified as CVE‑2026‑69446. The flaw originates in the WebView2 rendering engine, where a crafted HTML document can trigger a memory corruption that leads to arbitrary code execution with SYSTEM rights. The issue was discovered during internal security testing and has been assigned a CVSS score of 9.8, classifying it as critical.

The vulnerability is not remotely exploitable; an attacker must deliver a malicious file or lure a user to a malicious site that contains the exploit payload. Once the user opens the file or visits the site, the exploit can elevate the attacker’s privileges on the local machine without requiring additional credentials.

Who is affected

All users running Microsoft Edge versions 121.0.2272.0 through 123.0.2420.0 are susceptible. This includes the standard Edge browser shipped with Windows 10/11, as well as the Edge WebView2 component used by many third‑party applications. Enterprise deployments that rely on older Edge releases or that have not applied the latest cumulative update are at risk.

Because the flaw is tied to the WebView2 runtime, any application that embeds WebView2 without proper sandboxing could also be impacted. This includes desktop applications, Electron apps, and certain Windows Store apps that use the WebView2 control.

Impact

Successful exploitation results in the attacker gaining SYSTEM privileges on the compromised machine. This allows full control over the operating system, including installing malware, creating new user accounts, and bypassing all standard security controls. The attacker can also pivot to other systems on the network if lateral movement tools are available.

Given that the vulnerability requires local user interaction, the risk is primarily to end‑users who may inadvertently open malicious files or visit compromised websites. In a corporate environment, the threat is amplified if privileged users or administrators are targeted.

Exposure

The flaw is triggered by a specially crafted HTML file or by loading a malicious web page that contains the exploit payload. The attacker must have a vector to deliver the file or entice the user to visit the page. This could occur via phishing emails, malicious attachments, or compromised websites that host the exploit.

Once the user interacts with the malicious content, the exploit takes advantage of a buffer overflow in the WebView2 rendering engine, corrupting memory and enabling arbitrary code execution. The attack chain is local and does not rely on network services or remote code execution.

What to do

• Apply the latest Microsoft Edge update (version 124.0.2420.0 or later) via Windows Update or the Microsoft Edge Enterprise landing page.
• Verify that all installations of the WebView2 runtime are updated to the latest version (currently 1.0.2401.0 or newer).
• For applications that embed WebView2, enforce the sandbox mode and disable any elevated privileges unless absolutely necessary.
• Implement AppLocker or Defender Application Control rules to block execution of unknown HTML files or scripts that could contain the exploit payload.
• Educate users about the risks of opening unsolicited attachments and visiting untrusted websites; enforce safe browsing policies.
• Consider disabling the “Allow sites to use WebRTC” and “Enable hardware acceleration” features in Edge as a temporary mitigation if immediate patching is delayed.

What to watch

Microsoft has released a full advisory detailing the technical aspects of the vulnerability and the patch. Keep an eye on the Microsoft Security Response Center for any updates regarding new variants or additional mitigations.

Monitor threat intelligence feeds for reports of active exploitation attempts. While no widespread exploitation has been reported yet, the high severity and local nature of the flaw make it a prime target for targeted attacks against privileged users.