CVE-2026-77490: Microsoft Edge Chromium XSS Vulnerability

CVE-2026-77490 Overview

CVE-2026-77490 is a cross-site scripting (XSS) vulnerability in Microsoft Edge (Chromium-based). The flaw stems from improper neutralization of input during web page generation [CWE-79]. An unauthorized remote attacker can exploit it to perform spoofing attacks over a network. Exploitation requires user interaction, such as clicking a crafted link or visiting a malicious page.

Critical Impact
A successful attack allows script injection that can spoof content within the browser context, potentially enabling credential theft, session hijacking, or user deception across trust boundaries.

Affected Products

Microsoft Edge (Chromium-based)

Discovery Timeline

2026-09-11 - CVE-2026-77490 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-77490

Vulnerability Analysis

The vulnerability is a cross-site scripting flaw classified under [CWE-79]. Microsoft Edge fails to properly neutralize user-controlled input when generating web page content. Attacker-supplied data reaches the rendering context without adequate encoding or sanitization.

Because the scope is changed, injected script can affect resources beyond the vulnerable component's original security boundary. This enables spoofing of trusted UI elements or web content. The confidentiality and integrity impact is limited, but user-visible content can be manipulated to mislead victims.

Root Cause

The root cause is improper output encoding during web page generation. Input received from an untrusted source is rendered into the page without contextual escaping. Browser rendering then interprets the payload as executable script rather than inert data.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a malicious URL or web page containing the XSS payload. When a victim visits the resource in Microsoft Edge, the injected script executes in the browser context. The attacker can then spoof page content, mimic legitimate prompts, or redirect the user to attacker-controlled resources.

No verified public proof-of-concept code is available. For technical details, refer to the Microsoft Security Update Guide.

Detection Methods for CVE-2026-77490

Indicators of Compromise

Browser navigation to unfamiliar URLs containing encoded script fragments such as <script>, javascript:, or onerror= in query parameters
Unexpected redirects or spoofed login prompts rendered inside Microsoft Edge sessions
Outbound requests from Edge to newly registered or low-reputation domains shortly after link clicks in email or chat

Detection Strategies

Inspect proxy and web gateway logs for HTTP requests carrying suspicious script payloads in query strings or fragments
Correlate Microsoft Edge process telemetry with anomalous child process activity or credential prompts
Deploy content security policy (CSP) violation reporting on internal web applications to surface injection attempts

Monitoring Recommendations

Ingest Microsoft Edge browser and Windows endpoint telemetry into a centralized analytics platform for behavioral analysis
Alert on user-reported phishing or spoofing incidents that reference Edge-rendered content
Track Microsoft Edge version distribution across the fleet to identify unpatched hosts

How to Mitigate CVE-2026-77490

Immediate Actions Required

Update Microsoft Edge (Chromium-based) to the version identified in the Microsoft Security Update Guide
Verify that automatic browser updates are enabled and functioning across managed endpoints
Educate users to avoid clicking untrusted links, particularly those delivered through email, messaging, or social media

Patch Information

Microsoft has published remediation guidance in the Microsoft Security Update Guide for CVE-2026-77490. Administrators should apply the fixed Edge build referenced in the advisory and confirm deployment through configuration management tooling.

Workarounds

Enforce strict Content Security Policy headers on internally hosted web applications to reduce script injection impact
Restrict browsing to trusted sites via web filtering or SmartScreen policies until patches are deployed
Disable or limit JavaScript execution on high-risk sites through Edge group policy settings where operationally feasible

bash

# Verify installed Microsoft Edge version on Windows
reg query "HKLM\SOFTWARE\Microsoft\Edge\BLBeacon" /v version

# Force Edge update check via command line
"%ProgramFiles(x86)%\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler