CVE-2026-57977: Microsoft Edge Chromium XSS Vulnerability

CVE-2026-57977 Overview

CVE-2026-57977 is a cross-site scripting (XSS) vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to perform spoofing over a network. The flaw stems from improper neutralization of input during web page generation, tracked as [CWE-79]. Successful exploitation requires user interaction, typically convincing a victim to visit an attacker-controlled or compromised page. Microsoft published details in its Security Update Guide, and the issue affects the Chromium-based Edge browser.

Critical Impact
An attacker can inject script into rendered web content to spoof UI elements and manipulate integrity of information presented to the user, without requiring privileges on the target system.

Affected Products

Microsoft Edge (Chromium-based)

Discovery Timeline

2026-07-03 - CVE-2026-57977 published to the National Vulnerability Database (NVD)
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-57977

Vulnerability Analysis

The vulnerability is a cross-site scripting (XSS) issue classified under [CWE-79], improper neutralization of input during web page generation. Microsoft Edge fails to properly sanitize attacker-controlled input before it is incorporated into rendered content. As a result, an attacker can inject script or markup that executes in the context of a browser page. The listed impact focuses on spoofing, meaning attackers can manipulate the appearance or trusted elements of a page to mislead the user. Exploitation occurs over the network and requires the victim to interact with attacker-controlled content, such as clicking a crafted link.

Root Cause

The root cause is insufficient output encoding or input sanitization within Edge's handling of untrusted web content. When user-influenced data reaches a rendering path without proper neutralization, browser-interpreted characters such as <, >, and quote delimiters retain their control semantics. This allows script content to be reflected or stored in a way the rendering engine executes.

Attack Vector

Exploitation is remote and requires user interaction. An attacker crafts a malicious URL or web page and lures the victim into visiting it, typically through phishing or a compromised site. The injected payload runs in the browser context and can rewrite trusted UI elements, forge origin indicators, or overlay spoofed prompts to harvest credentials or coerce user actions. No verified proof-of-concept or public exploit code is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-57977

Indicators of Compromise

Browser telemetry showing navigation to newly registered or low-reputation domains delivering scripts that manipulate DOM elements outside their expected origin.
Unusual outbound requests from Edge processes to attacker-controlled hosts immediately following link clicks in email or chat clients.
User reports of Edge rendering unexpected authentication prompts, address-bar anomalies, or content that impersonates trusted brands.

Detection Strategies

Monitor endpoint EDR telemetry for msedge.exe child processes or renderer activity spawning from suspicious URLs referenced in email, messaging, or document files.
Inspect web proxy and DNS logs for access to URLs containing encoded script fragments or unusual query strings targeting Edge users.
Correlate phishing email indicators with Edge browsing history to identify users who followed suspect links.

Monitoring Recommendations

Enable Microsoft Defender SmartScreen and enterprise browsing telemetry to flag known malicious URLs delivering XSS payloads.
Ingest browser and proxy logs into a centralized SIEM and alert on high-risk domain categories and newly observed domains.
Track Edge version inventory across managed endpoints to identify hosts still running unpatched builds.

How to Mitigate CVE-2026-57977

Immediate Actions Required

Update Microsoft Edge (Chromium-based) to the fixed version listed in the Microsoft Security Update Guide CVE-2026-57977.
Verify that automatic Edge updates are enabled across the fleet and confirm the deployed build via edge://settings/help.
Reinforce user awareness on phishing links, since exploitation requires user interaction.

Patch Information

Microsoft has issued guidance and update information through the Microsoft Security Update Guide CVE-2026-57977. Administrators should apply the referenced Edge stable channel update and validate that endpoints report the patched version after deployment.

Workarounds

Restrict navigation to untrusted external sites using enterprise browser policies and URL allow lists where feasible.
Configure Microsoft Defender SmartScreen and network web filtering to block known phishing and malicious domains.
Deploy Group Policy or Intune settings that enforce Edge auto-update to reduce the window of exposure on managed devices.

bash

# Verify installed Microsoft Edge version on Windows
reg query "HKLM\SOFTWARE\Microsoft\Edge\BLBeacon" /v version

# Force an Edge update check via the update service
"%ProgramFiles(x86)%\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler