CVE-2024-26163: Microsoft Edge Chromium Auth Bypass Flaw

CVE-2024-26163 Overview

CVE-2024-26163 is a security feature bypass vulnerability in Microsoft Edge (Chromium-based). The flaw allows a remote attacker to bypass a browser security feature when a user interacts with attacker-controlled web content. Microsoft assigned the issue [CWE-693: Protection Mechanism Failure] and published the advisory on March 14, 2024. Successful exploitation requires user interaction and can result in a limited integrity impact with scope change, meaning the affected component can influence resources beyond its own security boundary.

Critical Impact
An attacker can bypass a security feature in Microsoft Edge to influence content outside the browser's intended security boundary, enabling downstream attacks such as spoofing or content injection.

Affected Products

Microsoft Edge (Chromium-based) — Stable channel
Microsoft Edge (Chromium-based) — Extended Stable channel
Microsoft Edge versions prior to the March 2024 security update

Discovery Timeline

2024-03-14 - CVE-2024-26163 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-26163

Vulnerability Analysis

CVE-2024-26163 is classified as a security feature bypass in the Chromium-based Microsoft Edge browser. Microsoft's advisory categorizes the root weakness as Protection Mechanism Failure ([CWE-693]), indicating that a browser-enforced security control does not behave as designed under specific conditions. The scope change component signals that a successful bypass in the browser process can affect data or components outside the vulnerable component's authority. Because confidentiality and availability are not impacted, the practical outcome is limited integrity modification, typically manifested as spoofing, UI manipulation, or bypass of a security prompt. Microsoft has not published a detailed technical write-up beyond the advisory.

Root Cause

The underlying weakness is a failure of a Microsoft Edge protection mechanism to consistently enforce its intended trust boundary. The advisory does not disclose the specific feature affected. Protection mechanism failures in Chromium-based browsers commonly involve origin checks, download security prompts, SmartScreen enforcement, or similar defenses that guard user interaction with untrusted content.

Attack Vector

Exploitation occurs over the network and requires user interaction, such as visiting a crafted web page or clicking a malicious link. An attacker must convince the target to load attacker-controlled content in Microsoft Edge. No authentication is required. Once the user interacts with the malicious content, the browser's security feature is bypassed, allowing the attacker to influence resources beyond the browser's normal scope.

No public proof-of-concept exploit is available. Microsoft has not reported active exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update Guide for the vendor advisory.

Detection Methods for CVE-2024-26163

Indicators of Compromise

Microsoft Edge instances running versions predating the March 2024 security update on managed endpoints
User navigation to unexpected external domains immediately followed by security prompt suppression or unusual download activity
Browser telemetry showing dismissed or absent SmartScreen or security warning events on downloaded content

Detection Strategies

Inventory installed Microsoft Edge versions across the estate and flag hosts running builds released before the March 14, 2024 update
Correlate web proxy logs with endpoint browser telemetry to identify user interaction with newly registered or low-reputation domains
Monitor for post-navigation execution of downloaded files that would normally trigger a Mark-of-the-Web or SmartScreen prompt

Monitoring Recommendations

Ingest Microsoft Edge update and version telemetry into your SIEM to track patch compliance over time
Alert on child processes spawned by msedge.exe that execute scripting engines or installers shortly after web navigation events
Track EPSS trend data for CVE-2024-26163, currently reported at approximately 2.075% probability, and re-prioritize if the score rises

How to Mitigate CVE-2024-26163

Immediate Actions Required

Apply the Microsoft Edge Stable or Extended Stable channel update referenced in the Microsoft Security Update Guide
Enable automatic updates for Microsoft Edge across managed endpoints using Group Policy or Intune
Verify patch deployment by auditing edge://version or querying installed application inventory

Patch Information

Microsoft addressed CVE-2024-26163 in the Microsoft Edge (Chromium-based) update released on March 14, 2024. Administrators should consult the Microsoft Security Update Guide for the specific fixed build number for the Stable and Extended Stable channels, then deploy the update through Microsoft Update, WSUS, Intune, or the Edge for Business admin console.

Workarounds

No official workaround has been published by Microsoft; patching remains the required remediation
Restrict user browsing to trusted sites via web proxy or DNS filtering until the update is applied
Reinforce user awareness training on clicking links and interacting with security prompts from untrusted sources

bash

# Verify installed Microsoft Edge version on Windows endpoints
powershell -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Edge\BLBeacon').version"

# Force update check via command line
"%ProgramFiles(x86)%\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler