Microsoft has disclosed CVE-2026-85893, a high-severity use-after-free vulnerability in Edge that could let an attacker elevate privileges from Low to Medium Integrity Level after a user visits a malicious page and performs two tap gestures. The flaw affects versions prior to 153.0.4234.32 and is rated CVSS 8.8, though exploitation is assessed as unlikely.
Successful exploitation could allow an attacker to elevate privileges from a Low Integrity Level in a sandboxed execution environment to a Medium Integrity Level.
The victim must visit an attacker-controlled webpage and perform two tap gestures that trigger autofill.
Organizations running Edge in enterprise environments should prioritize the update to 153.0.4234.32, as sandbox escapes remain a high-value target even when in-the-wild exploitation is currently unlikely.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
Microsoft published CVE-2026-62765 on Oct. 27, describing a type-confusion flaw in Microsoft Edge (Chromium-based) that could allow remote code execution, rated Important with a CVSS 3.1 score of 7.5. Microsoft's advisory lists it as not exploited and not publicly disclosed. The advisory's fixed-build number conflicts with Edge's own release notes, so the exact patched version is unconfirmed.
Microsoft has announced CVE-2026-118147, a high-severity spoofing vulnerability caused by improper certificate validation in Visual Studio. The flaw affects four product lines and requires immediate updates to the listed fixed builds.
The Analytics Insights – Google Analytics Dashboard for WordPress plugin is vulnerable to stored cross-site scripting tracked as CVE-2026-111820 in versions through 6.3.12. Unauthenticated attackers can inject scripts that execute for any visitor to an affected page.
A newly published CVE (CVE-2026-116199, assigned by VulnCheck on Oct 25) covers a flaw in Snipe-IT's Google SSO login. Versions before 8.6.3 didn't check whether an account was deactivated, so a former user whose Google account was still active could sign back in with their old permissions, including admin. It only applies when Google SSO is on and usernames are email addresses, and Snipe-IT says default installs aren't affected. The fix shipped in v8.6.3 on June 15, and the latest release is v8.8.3. VulnCheck scores it 9.2 Critical (CVSS 4.0) and 8.1 High (CVSS 3.1), while Snipe-IT's advisory rates it Moderate. It isn't in CISA's KEV catalog, and no public exploit or attacks have been reported.
ADT and Thrive Holdings announced an all-cash deal that values ADT at about $7.6 billion in equity value and $15.3 billion in enterprise value, according to the companies. ADT stockholders would get $10.00 per share, and the companies expect the deal to close in the first quarter of 2027, pending stockholder and US antitrust approval.
