Microsoft Edge Use-After-Free Flaw CVE-2026-85893 Rated High Severity

Microsoft has disclosed CVE-2026-85893, a high-severity use-after-free vulnerability in Edge that could let an attacker elevate privileges from Low to Medium Integrity Level after a user visits a malicious page and performs two tap gestures. The flaw affects versions prior to 153.0.4234.32 and is rated CVSS 8.8, though exploitation is assessed as unlikely.

Source:NVD

Post

Microsoft Edge Use-After-Free Flaw CVE-2026-85893 Rated High Severity

TL;DRAI · 60 sec read

Microsoft has disclosed a high-severity elevation of privilege vulnerability in its Chromium-based Edge browser. The flaw, tracked as CVE-2026-85893, carries a CVSS 3.1 base score of 8.8.

The vulnerability is a use-after-free flaw. It stems from CWE-416 and allows an unauthorized attacker to elevate privileges over a network. Microsoft rates the maximum severity as Important.

Successful exploitation could allow an attacker to elevate privileges from a Low Integrity Level in a sandboxed execution environment to a Medium Integrity Level.

Successful exploitation could allow an attacker to elevate privileges from a Low Integrity Level in a sandboxed execution environment to a Medium Integrity Level. The vulnerability has not been publicly disclosed or exploited in the wild. Exploitation is assessed as unlikely at the time of publication.

From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →

User interaction is required to trigger the flaw. The victim must visit an attacker-controlled webpage and perform two tap gestures that trigger autofill. The affected version range is Microsoft Edge versions prior to 153.0.4234.32, based on Chromium 153.0.8010.37 released September 10, 2026.

The victim must visit an attacker-controlled webpage and perform two tap gestures that trigger autofill.

The vulnerability was reported by two researchers. Nan Wang, known as @eternalsakura13, and Ziling Chen discovered and reported the issue. Microsoft recommends updating to the patched version 153.0.4234.32 or later.

The CVSS vector details the attack requirements. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C. No additional mitigations beyond patching are detailed in the advisory.

EXPERT TAKE

Organizations running Edge in enterprise environments should prioritize the update to 153.0.4234.32, as sandbox escapes remain a high-value target even when in-the-wild exploitation is currently unlikely.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported

DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee

Microsoft Edge Vulnerability Security

MORE IN TECH

Snap Launches $2,195 Specs AR Glasses for Consumers

Snap has launched Specs, its first consumer AR glasses priced at $2,195 with preorder availability and fall shipping in three countries. The standalone device offers a 51-degree display, dual Snapdragon processors, four-hour battery life, and features from multiplayer games to contextual AI, targeting mainstream AR adoption at a premium.

Microsoft Sets October 7 Windows and Surface Event With Nadella and Jensen Huang

Microsoft will hold a Windows and Surface event in San Francisco on October 7, 2026, framed as a conversation on how local AI will shape the next chapter of the PC. CEO Satya Nadella, Nvidia CEO Jensen Huang, and Windows and Surface lead Pavan Davuluri are expected to appear. Coverage is set for 10 a.m. PT / 1 p.m. ET.

CISA Adds Google Pixel Modem Flaw CVE-2026-58704 to KEV Catalog

CISA added CVE-2026-58704, an improper authorization vulnerability in Google Pixel cellular modems, to its Known Exploited Vulnerabilities catalog on September 16, 2026, with a remediation due date of September 19. Google’s Pixel bulletin notes indications of limited, targeted exploitation.