CVE-2026-66324

Received Received - Intake

Microsoft Edge Chromium-based File Name Path Spoofing

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: Microsoft Corporation

Description

External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-66324

EUVD

EUVD-2026-67850

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	edge	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

This vulnerability in Microsoft Edge (Chromium-based) allows an attacker to control file names or paths externally. This can be exploited to perform spoofing attacks over a network, potentially deceiving users into interacting with malicious content.

Impact Analysis

An attacker could trick you into downloading or opening files with misleading names or paths. This might lead to unauthorized actions, data exposure, or further compromise of your system if you interact with the spoofed content.

Mitigation Strategies

Apply the latest security updates from Microsoft for Microsoft Edge (Chromium-based) to patch the vulnerability. Monitor Microsoft's security advisories for updates and ensure all systems are updated promptly.

Hi! I’m here to help you understand CVE-2026-66324. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70