Microsoft Edge RCE: Critical Browser Vulnerability Hits Chromium Users

The National Vulnerability Database has issued an advisory for CVE-2026-45495, a high-severity Remote Code Execution (RCE) vulnerability affecting Microsoft Edge (Chromium-based). With a CVSS score of 8.8, this flaw presents a significant risk, allowing attackers to execute arbitrary code on a victim’s system, likely through user interaction like visiting a malicious website.

This isn’t just another browser bug; RCE in a widely used browser like Edge is a direct path to system compromise. The National Vulnerability Database identifies CWE-20 (Improper Input Validation), CWE-94 (Improper Control of Generation of Code), and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) as contributing weaknesses. These categories point to fundamental design or implementation flaws that attackers can readily exploit to bypass security controls and achieve arbitrary code execution.

For defenders, this means browser security is paramount. Attackers continuously refine their techniques to leverage client-side vulnerabilities, as they offer a direct pathway into an organization’s perimeter. Expect sophisticated phishing and drive-by download campaigns to weaponize such flaws, targeting end-users as the weakest link.