CVE-2026-66324

MediumCVSS 6.5/10Last modified Oct 28, 2026

Description

External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-73

Affected software

Vendor	Product	Versions
Microsoft	Microsoft Edge (Chromium-based)	>= 1.0.0.0, < 152.0.4191.53
Microsoft	Microsoft Edge for Android	>= 1.0.0.0, < 152.0.4191.52
Microsoft	Microsoft Edge for iOS	>= 1.0.0.0, < 152.0.4191.52
Microsoft	Microsoft Edge for Linux	>= 1.0.0, < 152.0.4191.52
Microsoft	Microsoft Edge for MAC	>= 1.0.0.0, < 152.0.4191.52
Microsoft	Microsoft Edge for Windows	>= 1.0.0.0, < 152.0.4191.52

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66324Vendor Advisory

Timeline

Published: Aug 28, 2026
Last modified: Oct 28, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-663256.1Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.CVE-2026-663268.8Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-66333.5A security flaw has been discovered in Yifang CMS up to 2.0.5. The impacted element is the function store of the file plugins/yifang_backend CVE-2026-663316.9Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport. This issue affect CVE-2026-663324.6AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Out-of-Bound Read” by local access. Successful exploitati CVE-2026-663334.8AMI APTIOV contains vulnerabilities in BIOS where privileged users may cause the “Out-of-Bounds Read” by local access. Successful exploitati CVE-2026-663346.8AMI APTIOV contains vulnerabilities in BIOS where privileged users may cause the “Out-of-Bounds Write” by local access. Successful exploitat CVE-2026-663356.8AMI APTIOV contains vulnerabilities in BIOS where privileged users may cause the “Heap-based Buffer Overflow” by local access. Successful ex CVE-2026-663376.5A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-r CVE-2026-663387.2A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts i CVE-2026-663396.5A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorizati CVE-2026-66346.3A weakness has been identified in usememos memos up to 0.22.1. This affects the function memos_access_token of the file src/App.tsx of the c