CVE-2026-66311

Analyzed Analyzed - Analysis Complete

Missing Authorization in Microsoft Edge Allows Local Tampering

Publication date: 2026-08-04

Last updated on: 2026-08-06

Assigner: Microsoft Corporation

Description

Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-04

Last Modified

2026-08-06

Generated

2026-08-24

AI Q&A

2026-08-04

EPSS Evaluated

2026-08-23

NVD

CVE-2026-66311

EUVD

EUVD-2026-52531

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	edge_chromium	to 151.0.4129.59 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability involves missing authorization in Microsoft Edge (Chromium-based). An unauthorized attacker can perform tampering actions locally on the affected system.

Detection Guidance

This vulnerability involves missing authorization in Microsoft Edge allowing local tampering. Detection requires checking for unauthorized modifications to Edge's configuration or files. Monitor system logs for suspicious Edge-related activities and verify Edge's integrity using built-in tools like Windows Defender or third-party endpoint detection solutions.

Impact Analysis

An attacker could modify local data or settings on your system without permission. This may lead to unauthorized changes, data tampering, or potential system instability.

Compliance Impact

This vulnerability allows unauthorized tampering locally, which could lead to unauthorized access or modification of sensitive data. This may impact compliance with GDPR by violating data integrity and confidentiality requirements, and with HIPAA by potentially exposing protected health information to unauthorized changes.

Mitigation Strategies

Update Microsoft Edge to the latest version immediately to patch the missing authorization vulnerability. Monitor for unusual local tampering activities and restrict local user permissions if possible.

Hi! I’m here to help you understand CVE-2026-66311. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70