CVE-2025-47181 — Link Following in Microsoft Edge Updater

CWE-59 — Link Following4 documents4 sources
Severity
8.8HIGHNVD
EPSS
1.2%
top 21.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Microsoft Edge UpdaterMicrosoft Edge Update
Timeline
PublishedMay 22
Latest updateMay 23

Description

Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 2.0 | Impact: 6.0

Affected Packages2 packages

▶NVDmicrosoft/edge_update< 1.3.195.61
▶CVEListV5microsoft/microsoft_edge_updater1.0.0.0 — 1.3.195.61

🔴Vulnerability Details

2
GHSA
GHSA-m3rx-6qww-mhm3: Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges↗2025-05-23
▶
CVEList
Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability↗2025-05-22
▶

📋Vendor Advisories

1
Microsoft
Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability↗2025-05-13
▶
CVE-2025-47181 — Link Following in Microsoft | cvebase