CVE-2026-41107: Microsoft Edge Information Disclosure Flaw

CVE-2026-41107 Overview

CVE-2026-41107 is an information disclosure vulnerability in Microsoft Edge (Chromium-based). The flaw stems from external control of file name or path, allowing an unauthorized remote attacker to read information across a trust boundary. Exploitation requires user interaction, typically by enticing a victim to visit a crafted web page or open a malicious link.

The vulnerability maps to [CWE-73] (External Control of File Name or Path) and [CWE-610] (Externally Controlled Reference to a Resource in Another Sphere). Microsoft assigned a CVSS 3.1 base score of 7.4 with a scope change, indicating that successful exploitation can impact resources beyond the browser's security boundary.

Critical Impact

An unauthenticated network attacker can disclose confidential information from Microsoft Edge users after a single user interaction, with no privileges required.

Affected Products

• Microsoft Edge (Chromium-based) — all versions prior to the fixed release
• Windows installations of Edge Chromium
• macOS and Linux installations of Edge Chromium

Discovery Timeline

• 2026-05-12 - CVE-2026-41107 published to NVD
• 2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-41107

Vulnerability Analysis

The vulnerability resides in how Microsoft Edge (Chromium-based) handles file name or path references supplied by external sources. Attacker-controlled input influences a resource reference that the browser resolves, causing Edge to access or expose data from a sphere the user did not intend.

Because the CVSS vector indicates a changed scope and high confidentiality impact with no integrity or availability impact, the issue is purely an information disclosure flaw. Exploitation can leak sensitive content such as local file metadata, cross-origin resource data, or session-related information. The required user interaction is consistent with a drive-by browsing scenario, where the victim visits a crafted page or clicks a malicious link.

The scope change is the most significant aspect of this vulnerability. It means the disclosure crosses a security authority — for example, a sandboxed renderer reaching content governed by a different origin or by the operating system file context.

Root Cause

The root cause is improper validation of externally supplied path or file name input, mapped to [CWE-73]. Edge accepts a reference whose target is influenced by an untrusted party and resolves it without sufficient restriction. The secondary weakness [CWE-610] reflects that the resolved reference points to a resource outside the expected security sphere.

Attack Vector

The attack vector is network-based with low attack complexity. An attacker hosts a malicious page or delivers a crafted link through phishing, malvertising, or a compromised site. When the victim interacts with the content, Edge processes the attacker-controlled file name or path and returns or exposes data the attacker can capture over the network. No authentication is required on the attacker side.

Verified public proof-of-concept code is not available. Refer to the Microsoft Security Update Guide for CVE-2026-41107 for vendor-supplied technical details.

Detection Methods for CVE-2026-41107

Indicators of Compromise

• Outbound HTTP/HTTPS requests from msedge.exe to newly registered or low-reputation domains immediately after user clicks.
• Unusual file:// or local-resource references appearing in Edge browser telemetry or network proxies.
• Edge renderer processes reading file paths or resources outside expected origin boundaries.

Detection Strategies

• Monitor browser process telemetry for anomalous resource resolution patterns involving externally supplied paths.
• Inspect web proxy logs for requests where query parameters or referers contain encoded file paths or UNC-style references.
• Correlate phishing email indicators with subsequent Edge browsing sessions that trigger atypical outbound traffic.

Monitoring Recommendations

• Track Microsoft Edge version inventory across the fleet and flag endpoints running pre-patch builds.
• Alert on Edge processes spawning network connections to domains tied to known malvertising or credential-harvesting infrastructure.
• Enable browser audit logging where available and forward events to a centralized analytics platform for retrospective hunting.

How to Mitigate CVE-2026-41107

Immediate Actions Required

• Update Microsoft Edge (Chromium-based) to the fixed version listed in the Microsoft Security Update Guide for CVE-2026-41107.
• Verify automatic browser update policies are enforced through Group Policy or Microsoft Intune.
• Restart Edge on all managed endpoints to ensure the patched binary is loaded.

Patch Information

Microsoft has released a security update addressing CVE-2026-41107. Administrators should consult the Microsoft Security Update Guide for the specific fixed build number and deployment guidance. Edge typically updates through its built-in updater, but enterprise environments should confirm rollout via management tooling.

Workarounds

• Restrict access to untrusted websites through web filtering and DNS-layer protection until the patch is deployed.
• Train users to avoid clicking links from unsolicited messages, since exploitation requires user interaction.
• Where feasible, route browser traffic through a TLS-inspecting proxy that can block requests carrying suspicious path parameters.