CVE-2026-69446: Microsoft Edge privilege escalation via incorrect authorization

CVE-2026-69446 · Severity: medium · CVSS 4.4 · Published 2026-10-30

Microsoft Edge, the web browser that protects users while browsing the internet, contains an authorization flaw that allows an authenticated attacker with local access to elevate their privileges on the system. An attacker exploiting this vulnerability could gain higher-level access to the compromised system and potentially access sensitive data or install malware.

Technologies: Microsoft Edge. Vendors: Microsoft.

Quick answers

Is CVE-2026-69446 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-69446 being exploited in the wild.
How severe is CVE-2026-69446?
Medium severity, with a CVSS score of 4.4, published 30 October 2026.
Which products and versions are affected?
Microsoft Edge.
Is there a fix for CVE-2026-69446?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-69446 attacked?
It is attacked with local access, in a web application.
Am I affected by CVE-2026-69446?
Check whether you run Microsoft Edge. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an incorrect authorization check in Microsoft Edge (Chromium-based) that permits privilege escalation. An authenticated attacker with local network or physical access can exploit this flaw to elevate privileges; the attack requires prior authorization or local system access. The fix exists and is available from Microsoft.

Affected products

  • Microsoft Edge

Timeline

  • 2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.