VulnSocial

CVE-2026-45494Disclosure(microsoft / edge_chromium)

LOWCVSS 6.1 · MEDIUM

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

  • Patch microsoft edge_chromium systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Microsoft Edge (Chromium-based) Spoofing Vulnerability

microsoft CVEsBack to dashboard
2.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • edge_chromium

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 2 signals
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked at 2 mentions on most recent observed day (2026-06-05)
  • 3 total mentions across 2 days

Affected systems

Vendors
microsoft
Products
edge_chromium

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-06-04: 1Mentions · 2026-06-05: 2PoC Mentioned / Linked · 2026-06-04: 1PoC Mentioned / Linked · 2026-06-05: 1Patch / Workaround · 2026-06-05: 1Technical Details · 2026-06-04: 1Technical Details · 2026-06-05: 106-0406-05
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-041
Disclosure1
2026-06-052
Disclosure1General1
Full discourse3 posts
  • TheZDIBugs@TheZDIBugs
    Disclosure

    [ZDI-26-330|CVE-2026-45494] (Pwn2Own) Microsoft Edge Navigation Handling Universal Cross-Site Scripting Vulnerability (CVSS 5.0; Credit: Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3)) https://www.zerodayinitiative.com/advisories/ZDI-26-330/

    Post summary

    This brief notes the disclosure of CVE-2026-45494, a universal XSS vulnerability in Microsoft Edge, with a PoC referenced via the ZDI link but no active exploitation, patch, or false‑positive claim reported.

    27058194.7K
    5.6K followersView on X
  • BnSnK@BunSnack
    Disclosure

    Orange Tsai (DEVCORE) found CVE-2026-45495 in Microsoft Edge — unvalidated file path in feedback log handling allows code execution in the logged-in user context. Patched June 4. Also: CVE-2026-45494, CVE-2026-45492. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45495

    Post summary

    Microsoft Edge CVE‑2026‑45495 permits code execution via an unvalidated file path in the feedback log; the issue was patched on June 4.

    0003025
    6 followersView on X
  • たるいひでと@TaruiHideto
    General

    CVE-2026-45494 https://www.zerodayinitiative.com/advisories/ZDI-26-330/ CVE-2026-45492 https://www.zerodayinitiative.com/advisories/ZDI-26-329/

    Post summary

    The provided text lists two CVE identifiers and links to ZeroDayInitiative advisories, but offers no additional details on exploits, patches, or technical specifics.

    0000053
    544 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appmicrosoftedge_chromium---

Explore more

Back to dashboardmicrosoft CVEsedge_chromium vulnerabilities