‹ Back to list

CVE-2026-96196

High (8.8)—
Schedule the patchSeverity High 8.8. No public exploit or active exploitation known.
Vendor advisory· msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96196
Severity8.8High · CVSS 3.1
Exploitation probability0.75 %higher than 55% of CVEs · score from Nov 11, 2026
Active exploitationNonot in the CISA catalog · checked Nov 12, 04:00 AM
Public exploitNot knownno public code found

News and reports on Orbitaley

Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

Timeline

Built from our own data: NVD, CISA KEV and other exploitation catalogues, FIRST EPSS, public exploits, specialised media and Orbitaley coverage.

  1. CVE record published in NVD
  2. Alert: Microsoft fixes five serious Edge flaws and an ASP.NET Core privilege escalation bug
  3. Record last modified in NVD

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vector AV:N/PR:N/UI:R implica ejecución en el cliente con interacción del usuario (T1203). La descripción solo menciona un bypass de una función de seguridad, sin impacto concreto, por lo que no se asignan impactos.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Application Isolation and SandboxingExploit ProtectionUpdate Software

Affected technologies (1)

Microsoft — Edge Chromium

NVD record

NVD status
Analyzed
Published
Oct 29, 2026
Last modified
Nov 3, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-184

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-96196",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-96196",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-30T03:56:35.017904Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secure@microsoft.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Microsoft Edge (Chromium-based)",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.0",
              "lessThan": "156.0.4314.50",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-29T16:20:08.477",
  "references": [
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96196",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secure@microsoft.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-184"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network."
    }
  ],
  "lastModified": "2026-11-03T17:55:01.717",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "908D512A-1403-4B5A-A821-852C1C64089E",
              "versionEndExcluding": "156.0.4314.50"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}