Skip to content
Advisories.
microsoftCVE-2026-88097

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.

High8.1CVE-2026-88097 · Published Sep 18, 2026 · updated Sep 24, 2026

Source advisory

Affected versions

PackageAffectedFixed in
Microsoft Edge (Chromium-based)
Vendor
>= 1.0.0.0, < 153.0.4234.46153.0.4234.46
Details and references

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.

CVSS 3.1
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity from
no source yet
Weakness
CWE-416

More microsoft advisories

All
DateAdvisory
Sep 18Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-62874Critical10.0no fix yet
Sep 18Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-69843Critical10.0no fix yet
Sep 18Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-83946High8.2no fix yet
Sep 18Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.
CVE-2026-85878Critical9.9no fix yet
Sep 18Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.
CVE-2026-85887High7.7no fix yet
Sep 17Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
CVE-2026-85885Critical9.9no fix yet

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.