CVE-2026-55945: Microsoft Edge Chromium Race Condition

CVE-2026-55945 Overview

CVE-2026-55945 is a race condition vulnerability in Microsoft Edge (Chromium-based) that allows an authorized local attacker to disclose information. The flaw stems from concurrent execution using a shared resource with improper synchronization, categorized under [CWE-362]. Exploitation requires local access, low privileges, and high attack complexity, resulting in limited confidentiality and integrity impact with a scope change.

The vulnerability affects Microsoft Edge Chromium and was published to the National Vulnerability Database (NVD) on July 3, 2026. Microsoft has issued a security advisory through the Microsoft Security Response Center (MSRC) update guide.

Critical Impact
Authorized local attackers can win a timing race to read information that crosses a security boundary, potentially disclosing sensitive browser data across origins or process contexts.

Affected Products

Microsoft Edge (Chromium-based) — all versions prior to the fixed release
Windows platforms running vulnerable Edge builds
Enterprise deployments using Edge as the managed browser

Discovery Timeline

2026-07-03 - CVE-2026-55945 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-55945

Vulnerability Analysis

The vulnerability is a race condition ([CWE-362]) in Microsoft Edge (Chromium-based). Multiple concurrent execution paths access a shared resource without adequate synchronization primitives. When an attacker times operations precisely, the browser exposes state that should remain isolated. The scope change indicated in the vector reflects that a successful exploit affects resources beyond the vulnerable component, such as content managed by another origin or renderer context.

The attack complexity is high because the attacker must reliably win a narrow timing window. The impact is bounded to partial confidentiality and integrity disclosure, with no availability impact. Successful exploitation does not grant code execution but can leak information useful for follow-on attacks such as session token theft, cross-origin data reads, or credential harvesting.

Root Cause

The root cause is improper synchronization on a shared resource accessed by concurrent threads or processes within the Edge Chromium codebase. Without proper locking, ordering guarantees, or atomic operations, one execution path observes an inconsistent intermediate state written by another. Microsoft has not disclosed the specific component. Refer to the Microsoft Security Update CVE-2026-55945 advisory for authoritative technical details.

Attack Vector

An authorized local attacker executes code on the same system where Edge runs. The attacker triggers concurrent browser operations designed to race a target resource. Winning the race causes Edge to expose data across a trust boundary. Because user interaction is not required and the attacker already has local low-privileged access, the vulnerability is most relevant on multi-user systems, shared workstations, and Virtual Desktop Infrastructure (VDI) hosts.

No public proof-of-concept exploit is available at this time, and the vulnerability is not listed in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog. The Exploit Prediction Scoring System (EPSS) score is 0.145%.

Detection Methods for CVE-2026-55945

Indicators of Compromise

Unexpected Edge child processes spawned by low-privileged local users on shared or terminal-services hosts
Anomalous inter-process access patterns targeting Edge renderer or utility processes
Repeated, rapid launches of Edge with unusual command-line flags aimed at forcing concurrent operations

Detection Strategies

Inventory Edge Chromium versions across the environment and flag any endpoints not on the patched build
Monitor process telemetry for local user accounts interacting programmatically with msedge.exe and its subprocesses
Alert on scripts or binaries launched from user-writable directories that invoke Edge in headless or automation modes

Monitoring Recommendations

Collect endpoint process and command-line telemetry into a centralized data lake for retrospective hunting
Track browser update compliance as a security key performance indicator (KPI) and alert on drift
Correlate local logon events with subsequent Edge automation activity to surface reconnaissance behavior

How to Mitigate CVE-2026-55945

Immediate Actions Required

Update Microsoft Edge (Chromium-based) to the fixed version referenced in the Microsoft Security Update CVE-2026-55945 advisory
Verify Edge auto-update is enabled through group policy or Microsoft Intune on all managed endpoints
Restrict interactive local logon rights on shared systems to reduce the population of authorized attackers

Patch Information

Microsoft has published patch guidance in the MSRC update guide. Administrators should confirm the deployed Edge Stable channel version matches or exceeds the fixed build listed in the advisory. Enterprise deployments using the Microsoft Edge Update service should validate that update rings are not paused. Refer to the Microsoft Security Update CVE-2026-55945 advisory for exact version numbers.

Workarounds

Enforce least-privilege on multi-user hosts to limit which accounts can execute local code alongside Edge
Apply application control policies to block unauthorized binaries from launching Edge with automation flags
Isolate high-value browsing sessions on dedicated hosts where untrusted local users cannot execute code

bash

# Verify installed Microsoft Edge version on Windows via PowerShell
(Get-Item "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe").VersionInfo.ProductVersion

# Force an Edge update check
Start-Process "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" -ArgumentList "/ua /installsource scheduler"