CVE-2026-0102: Microsoft Edge Chromium Info Disclosure

CVE-2026-0102 Overview

CVE-2026-0102 is an Information Disclosure vulnerability affecting Microsoft Edge Chromium. Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consent. This could result in disclosure of stored autofill data such as addresses, email, or phone number metadata.

Critical Impact

Sensitive user information stored in browser autofill (addresses, email addresses, phone numbers) may be disclosed to malicious websites without proper user consent through a two-tap interaction bypass.

Affected Products

• Microsoft Edge Chromium (all versions prior to patch)

Discovery Timeline

• 2026-02-17 - CVE-2026-0102 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-0102

Vulnerability Analysis

This vulnerability falls under CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor). The flaw exists in how Microsoft Edge Chromium handles autofill form population events. Under normal circumstances, autofill functionality requires explicit user consent before populating form fields with stored personal data. However, this vulnerability allows malicious webpages to bypass this consent mechanism through a crafted two-tap interaction sequence.

The attack leverages the browser's autofill subsystem, which is designed to improve user experience by automatically filling in forms with saved information. The vulnerability occurs when the browser incorrectly interprets two consecutive tap events as valid user consent, even when the user's intent was not to authorize autofill population.

Root Cause

The root cause stems from improper validation of user consent in the autofill event handling logic. The browser fails to adequately distinguish between intentional user interactions meant to authorize autofill and other tap events that may occur in rapid succession. This creates a race condition-like scenario where the autofill system can be triggered without the user clearly understanding or consenting to the data disclosure.

Attack Vector

The attack is network-based and requires user interaction. An attacker would need to craft a malicious webpage that:

1. Contains form fields configured to receive autofill data
2. Implements JavaScript or DOM manipulation to induce two rapid tap events
3. Positions interactive elements to maximize the likelihood of triggering the consecutive taps
4. Captures the autofilled data and exfiltrates it to attacker-controlled infrastructure

The attack requires high complexity to execute successfully, as the specific conditions needed to trigger the autofill bypass must align with user behavior. The attacker must convince the victim to visit the malicious page and interact with it in a manner that produces the required tap sequence.

Detection Methods for CVE-2026-0102

Indicators of Compromise

• Unusual form submission events containing autofill data to unfamiliar domains
• Network traffic showing exfiltration of personal information (addresses, emails, phone numbers) to third-party servers
• Browser history showing access to suspicious or newly registered domains with form-heavy content
• JavaScript console logs or network requests indicating rapid DOM manipulation around form elements

Detection Strategies

• Monitor for anomalous outbound network connections following visits to untrusted websites
• Implement web content filtering to block known malicious domains exploiting browser vulnerabilities
• Deploy endpoint detection and response (EDR) solutions capable of monitoring browser behavior and form submissions
• Review browser extension and autofill settings across enterprise endpoints for unauthorized modifications

Monitoring Recommendations

• Enable enhanced browser logging to capture autofill-related events and form submissions
• Configure web proxies to inspect and log form data submissions for sensitive information patterns
• Implement Data Loss Prevention (DLP) rules to detect potential PII exfiltration via web traffic
• Regularly audit browser versions across the organization to ensure timely patching

How to Mitigate CVE-2026-0102

Immediate Actions Required

• Update Microsoft Edge Chromium to the latest patched version as soon as available
• Consider temporarily disabling autofill functionality for sensitive data types (addresses, phone numbers, email) until patching is complete
• Educate users about the risks of interacting with unfamiliar or suspicious websites
• Review and restrict autofill permissions in enterprise browser policies

Patch Information

Microsoft has released a security advisory for this vulnerability. Organizations should consult the Microsoft Security Response Center Advisory for official patch information and remediation guidance. Applying the vendor-provided security update is the recommended remediation approach.

Workarounds

• Disable browser autofill for addresses, phone numbers, and email fields via browser settings or Group Policy
• Implement browser isolation solutions to contain potential exploitation attempts
• Use browser extensions or security tools that provide additional consent prompts for autofill actions
• Configure Content Security Policy (CSP) headers on internal applications to mitigate risks from injected content

# Microsoft Edge Group Policy configuration to disable autofill
# Navigate to: Administrative Templates > Microsoft Edge > Password manager and protection
# Set "Enable AutoFill for addresses" to Disabled
# Set "Enable AutoFill for payment instruments" to Disabled

# Registry-based workaround for Windows endpoints
reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v AutofillAddressEnabled /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v AutofillCreditCardEnabled /t REG_DWORD /d 0 /f