Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
References
| Link | Resource |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42838 | Vendor Advisory |
Configurations
History
14 May 2026, 14:26
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Microsoft
Microsoft edge Chromium |
|
| CPE | cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:-:*:*:* | |
| References | () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42838 - Vendor Advisory |
12 May 2026, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-12 18:17
Updated : 2026-05-14 14:26
NVD link : CVE-2026-42838
Mitre link : CVE-2026-42838
CVE.ORG link : CVE-2026-42838
JSON object : View
Products Affected
microsoft
- edge_chromium
CWE
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')