The Circuitry
THE CIRCUITRYYour one-stop source for all tech news
HOMETODAYNEWSFEEDEVENTS
BOOKMARKS
RSS
© 2026 The Circuitry
About UsSourcesContactCorrectionsPrivacy
  • Today
  • Feed
  • Events
  • Saved
Scroll for more
Verification
VERIFIEDConfidence: HIGH
Source identified
Claims cross-referenced
No discrepancies found
Fact-check summary

NVD and Feedly confirm the CVE-2026-57989 origin validation error in Microsoft Edge (CVSS 7.4) affecting versions prior to 150.0.4078.99.

Sourcing
1source

via NVD

NVD · track record
18Stories
100%Verified
1430d
All sources →
Markets
MSFT···

Live quote · not investment advice

Home/Tech/Microsoft Edge Origin Validation Flaw CVE-2026-57989 Rated High Severity
VERIFIEDBy Xavier Rivera· ·1 min read

Microsoft Edge Origin Validation Flaw CVE-2026-57989 Rated High Severity

Microsoft disclosed CVE-2026-57989, a high-severity origin validation error in Chromium-based Edge that lets an unauthorized attacker disclose information over a network. The flaw is rated CVSS 7.4 and affects versions before 150.0.4078.99.

Source:NVD
Post
Microsoft Edge Origin Validation Flaw CVE-2026-57989 Rated High Severity
TL;DRAI · 60 sec read

Microsoft disclosed CVE-2026-57989, a high-severity origin validation flaw in its Chromium-based Edge browser. The vulnerability permits an unauthorized attacker to disclose information over a network with a CVSS 3.1 score of 7.4. It affects versions prior to 150.0.4078.99, requiring users to install the available security update from Microsoft.

Microsoft has disclosed a high-severity origin validation error in its Chromium-based Edge browser that can allow an unauthorized attacker to disclose information over a network.

The vulnerability carries a CVSS 3.1 base score of 7.4. The flaw is tracked as CVE-2026-57989. It affects Microsoft Edge versions prior to 150.0.4078.99.
An unauthorized attacker could exploit the flaw to disclose information.

The issue was published to the CVE List and added to the NVD dataset on July 26, 2026. Microsoft Corporation provided the CVSS vector string AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. This indicates network attack vector, low attack complexity, no privileges required, user interaction required, changed scope, high confidentiality impact, and no integrity or availability impact.
From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →
The weakness is classified as CWE-346 Origin Validation Error. An unauthorized attacker could exploit the flaw to disclose information. The vulnerability was received from Microsoft Corporation on July 26, 2026 at 2:18:25 PM.
This indicates network attack vector, low attack complexity, no privileges required, user interaction required, changed scope, high confidentiality impact, and no integrity or availability impact.
Details appear in Microsoft's security update guide. The reference is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57989. No additional metrics for CVSS 4.0 or 2.0 were provided by NVD at publication.
The affected product is listed as Microsoft Edge (Chromium-based) version 1.0.0.0 less than 150.0.4078.99. Users should update to the fixed version once available from Microsoft.

EXPERT TAKE

Enterprise security teams should prioritize patching Edge to the 150.0.4078.99 release to mitigate the high confidentiality risk from this network-reachable flaw.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported
DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE
From The Circuitry

See what’s happening right now

The Feed runs all day — short, verified briefs the moment they break.

Open the Feed →
From The Circuitry

Follow @thecircuitry_

Every story we publish, as it happens. No noise between.

Follow on X ↗On Bluesky ↗

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee
MicrosoftEdgeVulnerabilitySecurity
More fromNVD
  • IBM Db2 Releases Face Privilege Escalation Risk

    Tech · 4d
  • Microsoft Azure Kubernetes Service CVE-2026-50516 Hits CVSS 9.4

    Tech · 5d
  • Zyxel WAX650S Firmware Hit by High-Severity Command Injection Flaw

    Tech · 12d
More inTech
  • iOS 27 Beta 5 Released as iPhone 18 Pro Details Surface

    Tech · 1d
  • ShinyHunters Extortion Gang Leaks Data from 1.6 Million RingCentral Accounts

    Tech · 1d
  • SpaceX completes $60 billion purchase of AI coding firm Cursor

    Tech · 1d
SupportThe Work

The Circuitry is reader-supported. If you find the daily brief useful, you can buy me a coffee to keep it going.

Buy a coffee →
SubscribeCircuitry Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Free forever.

MORE IN TECH

iOS 27 Beta 5 Released as iPhone 18 Pro Details Surface

The fifth beta of iOS 27 arrived this week alongside an alleged iPhone 18 Pro Max battery leak showing 5,391 mAh capacity, screen protector images confirming asymmetric corners on the foldable iPhone Ultra, and Mark Gurman's report on radical Apple Watch redesigns that may include round faces and screenless trackers.

ShinyHunters Extortion Gang Leaks Data from 1.6 Million RingCentral Accounts

ShinyHunters obtained and later leaked personal data belonging to 1.6 million RingCentral accounts after a July breach. The incident touched only a limited portion of the cloud communications provider’s customers and left core services untouched.

SpaceX completes $60 billion purchase of AI coding firm Cursor

SpaceX has completed its $60 billion acquisition of AI coding startup Cursor, granting the company access to the world's largest GPU fleet for lower-cost model development. The deal, which began with an April partnership and follows SpaceX's merger with xAI, has already produced Grok 4.5 and 4.6 focused on coding and real-world tasks.