CVE-2026-42838

published 2026-05-12

CVE-2026-42838: Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Edge (Chromium-based) allows an unauthorized…

medium 5.4 CVSS 3.1

AV N AC L PR N UI R S U C L I L A N

Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
microsoft	edge_chromium	< 148.0.3967.55	148.0.3967.55
microsoft	microsoft_edge	>= 1.0.0.0 < 148.0.3967.55	148.0.3967.55

CWE-74